fix issue 62892: record/file match on secret and one-time url

[ivis-kondo]

• Add an identity check between the issued secret/one-time URL record (record_id, file_name) and the item/file actually being requested.
• Fix the four management-operation handlers: each caught its own abort(403)/abort(404) in a broad except Exception and turned it into a 500 response.
• Fix is_private_index() to correctly reject an item when it belongs to multiple indexes that are all non-public.
• Add and update unit tests accordingly.

Summary by Sourcery

Enforce target matching for issued download URLs and preserve correct authorization and not-found responses across URL management operations.

Bug Fixes:

• Prevent secret and one-time download URLs from being used with a different record or file.
• Preserve intended 403 and 404 responses for secret and one-time URL management operations instead of converting them to 500 errors.
• Correct private-index detection for items belonging to multiple indexes and items with no indexes.

Tests:

• Add coverage for URL record/file matching, token type isolation, management-operation status codes, cross-item URL access, and private-index decision cases.

[sourcery-ai]

Reviewer's Guide

The PR prevents secret and one-time URL reuse against another record or file, fixes management handlers that converted intended 403/404 responses into 500s, corrects multi-index privacy evaluation, and adds comprehensive regression tests.

Sequence diagram for validating secret and one-time URL targets

sequenceDiagram
    participant Client
    participant DownloadView
    participant Utils
    participant URLRecord

    Client->>DownloadView: Request record_id and file_name with token
    DownloadView->>Utils: validate_url_download(record, filename, token)
    Utils->>Utils: convert_token_into_obj(token, is_secret_url)
    Utils->>Utils: ensure_url_record_matches(url_obj, record_id, file_name)
    alt record and file match
        Utils-->>DownloadView: Valid URL
        DownloadView-->>Client: Allow download
    else target mismatch or invalid URL record
        Utils-->>DownloadView: False and unavailable message
        DownloadView-->>Client: Reject download
    end

Loading

Sequence diagram for safe secret and one-time URL management

sequenceDiagram
    actor User
    participant ManagementView
    participant URLRecord
    participant Utils

    User->>ManagementView: Copy or delete URL
    ManagementView->>Utils: can_manage_secret_url() or can_manage_onetime_url()
    alt insufficient permissions
        ManagementView-->>User: 403 Forbidden
    else permitted
        ManagementView->>URLRecord: get_by_id(url_id)
        ManagementView->>Utils: ensure_url_record_matches(url_record, pid, file_name)
        alt missing or mismatched URL record
            ManagementView-->>User: 404 Not Found
        else matching URL record
            ManagementView->>URLRecord: create_download_url() or delete_logically()
            ManagementView-->>User: Complete operation
        end
    end

Loading

Flow diagram for multi-index privacy evaluation

flowchart TD
    A[Record] --> B{path exists?}
    B -- No --> C[Private]
    B -- Yes --> D["Indexes.is_public_state_and_not_in_future(path)"]
    D -- True --> E[Not private]
    D -- False --> C

Loading

File-Level Changes

Change	Details	Files
Enforce that secret and one-time download URLs are used only for their originally issued record and file.	Added a shared type-safe record/file matching helper. Applied matching checks to download validation and all copy/delete management handlers. Return indistinguishable 404 responses for missing and mismatched URL records.	modules/weko-records-ui/weko_records_ui/utils.py modules/weko-records-ui/weko_records_ui/views.py modules/weko-records-ui/tests/test_utils.py modules/weko-records-ui/tests/test_views.py
Preserve intended HTTP error responses in management operations while retaining 500 handling for unexpected failures.	Excluded Werkzeug HTTP exceptions from broad exception handling so abort(403) and abort(404) propagate. Updated management-operation tests to assert real 403/404 responses and genuine 500 responses.	modules/weko-records-ui/weko_records_ui/views.py modules/weko-records-ui/tests/test_views.py
Correct private-index determination for records associated with multiple indexes.	Treat records with no index path as private. Delegate public-state evaluation to the index-tree API and mark a record private unless at least one fully public index chain exists. Added decision-table and short-circuit tests for public, non-public, deleted, future-dated, and empty-path cases.	modules/weko-records-ui/weko_records_ui/utils.py modules/weko-records-ui/tests/test_utils.py
Expand regression coverage for token type isolation and URL target validation.	Verify secret and one-time tokens cannot be cross-validated. Cover matching and all record/file mismatch combinations for both URL types, including malformed and unusual inputs.	modules/weko-records-ui/tests/test_utils.py

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: dd274b34-2b99-4f39-8950-c14f528d6f41

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. This changes the authorization boundary for secret and one-time download URLs: a defect in the record/file matching check could expose files through a valid token issued for another target, or incorrectly block access across all such URLs. Reverting removes the new check, but any files exposed while the faulty behavior was live would not be recovered by the revert.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook