Preview attachment references can target missing job files #117

New Issue

2026-10-16T22:50:14Z

eleith-gitea-agent Bot commented

2026-10-16 22:50:14 +00:00

Problem / evidence

Preview's worker transform list does not include attachment, so ordinary attachment files are not copied into the job output directory. Meanwhile assemblePreview retains source-path attachment passthrough records in piece.assets for renderer compatibility. In Preview mode, helpers.getPieceAssetUrl(key, 'attachment') routes those paths through the job asset endpoint, where the file may not exist.

This predates PR #115: the passthrough assembly, omitted attachment transform and job-relative helper routing are present in its base 7fae03e5bbce7d981fbda08af01b1f97dbefd211. This is a source-level finding, not a live 404 reproduction or a newly introduced PR regression.

Reproduction to verify

Use a piece with an existing file (for example a PDF) in a configured attachment field.
Use a renderer that exposes that field through getPieceAssetUrl(..., 'attachment'). The default Page has no automatic attachment list, so a normal UI reproduction may not exist for every piece type.
Open the completed Preview Page and follow its attachment link. Inspect the resulting /admin/preview/<job>/asset/<path> URL and response.
Expected suspected failure: a valid relative passthrough path targets a missing file in the job directory and returns 404, even though the original attachment exists in the archive. Compare with Published only when that attachment has actually been published.

Overview deliberately lists only actual worker outputs; it correctly does not promote passthrough references into generated artifacts. This is not an Overview-inspector bug.

Scope / decision

Reproduce with a controlled fixture before changing behavior.
Choose with the owner: support attachments in Preview using the existing attachment transform to copy files into the job directory (extra IO/storage, normal Preview retention), or explicitly leave them unsupported without offering nonfunctional links.
If supported, ensure helper lookup selects the real job-local artifact and Overview reports only actual outputs. Preserve renderer/helper contracts and publish behavior.
Do not weaken asset-directory containment or introduce an archive-directory escape/fallback to make links work. No new copy/provider framework is preselected.

Sources

apps/web/src/lib/pieces/preview/assemble.server.ts — attachmentPassthroughs and assets assembly.
packages/web/worker/src/steps/preview-transform.ts — PREVIEW_TRANSFORM_NAMES.
packages/web/worker/src/workflows/preview.ts — per-job output directory and recorded transforms.
apps/web/src/lib/pieces/helpers.ts and packages/web/pieces/src/helpers.ts — Preview URL routing and asset lookup.

Inspected at 34c24f7e4678d9102606de47562ada1bfc16c3d0. Separate follow-up from #115; no live jobs/file-serving probes or implementation performed when filing.

## Problem / evidence Preview's worker transform list does not include `attachment`, so ordinary attachment files are not copied into the job output directory. Meanwhile `assemblePreview` retains source-path attachment passthrough records in `piece.assets` for renderer compatibility. In Preview mode, `helpers.getPieceAssetUrl(key, 'attachment')` routes those paths through the job asset endpoint, where the file may not exist. This predates PR #115: the passthrough assembly, omitted attachment transform and job-relative helper routing are present in its base `7fae03e5bbce7d981fbda08af01b1f97dbefd211`. This is a source-level finding, **not a live 404 reproduction or a newly introduced PR regression**. ## Reproduction to verify 1. Use a piece with an existing file (for example a PDF) in a configured attachment field. 2. Use a renderer that exposes that field through `getPieceAssetUrl(..., 'attachment')`. The default Page has no automatic attachment list, so a normal UI reproduction may not exist for every piece type. 3. Open the completed Preview Page and follow its attachment link. Inspect the resulting `/admin/preview/<job>/asset/<path>` URL and response. 4. Expected suspected failure: a valid relative passthrough path targets a missing file in the job directory and returns 404, even though the original attachment exists in the archive. Compare with Published only when that attachment has actually been published. Overview deliberately lists only actual worker `outputs`; it correctly does not promote passthrough references into generated artifacts. This is not an Overview-inspector bug. ## Scope / decision - Reproduce with a controlled fixture before changing behavior. - Choose with the owner: support attachments in Preview using the existing attachment transform to copy files into the job directory (extra IO/storage, normal Preview retention), or explicitly leave them unsupported without offering nonfunctional links. - If supported, ensure helper lookup selects the real job-local artifact and Overview reports only actual outputs. Preserve renderer/helper contracts and publish behavior. - Do not weaken asset-directory containment or introduce an archive-directory escape/fallback to make links work. No new copy/provider framework is preselected. ## Sources - `apps/web/src/lib/pieces/preview/assemble.server.ts` — `attachmentPassthroughs` and assets assembly. - `packages/web/worker/src/steps/preview-transform.ts` — `PREVIEW_TRANSFORM_NAMES`. - `packages/web/worker/src/workflows/preview.ts` — per-job output directory and recorded transforms. - `apps/web/src/lib/pieces/helpers.ts` and `packages/web/pieces/src/helpers.ts` — Preview URL routing and asset lookup. Inspected at `34c24f7e4678d9102606de47562ada1bfc16c3d0`. Separate follow-up from #115; no live jobs/file-serving probes or implementation performed when filing.

~~eleith-gitea-agent Bot referenced this issue 2026-10-16 22:53:44 +00:00~~

Piece viewer — incremental review #115

eleith-gitea-agent Bot referenced a pull request that will close this issue

2026-10-17 00:39:59 +00:00

[web] fix Preview job switching and attachment downloads #119

eleith closed this issue

2026-10-17 01:01:07 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eleith/luzzle#117