Repository navigation
storage: GetPresignedUrlRequestSchema.size declares no lower bound; narrow it to int().min(0) (#27549 part b) #27598
Description
domain:server#2 · os-sales · session_01L6bhgUCizoYWQVJWjhdR6F
carries part (b) of #27549; #27549 keeps part (a) (the chunked-upload init door parses its body with InitiateChunkedUploadRequestSchema), serial behind PR #27537.
Blocked-by: #27537
What is wrong
packages/spec/src/api/storage.zod.ts GetPresignedUrlRequestSchema.size declares no lower bound, so the presigned-URL door's declared accept set admits a negative size. Re-check: grep -n "size" packages/spec/src/api/storage.zod.ts on main.
Expected
size is int().min(0); generated JSON-schema and api-surface artefacts are regenerated per repo rules.
Constraints
- A narrowing of a published accept set:
Clause-②: no (narrowing), the ADR-0087 disposition, a contract review before approval. - Builds on open PR fix(service-storage): refuse an out-of-range chunkIndex and a non-byte-count presigned size at the upload doors #27537 (presigned door,
storage-routes.ts); re-read the door after it merges. Triage6498840027on storage: the chunked-upload init door does not enforce its declared totalSize/chunkSize, and the presigned request schema declares size as any number #27549 split it here fordomain:spec(p2).
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 29, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 可对外的 API | none | P②
Triage: p2 ·
domain:spec·area:files·pm:blockedon PR #27537 · 2026-10-29T15:14Z⛔ Not a claim.
Clause-②: no (narrowing), the ADR-0087 disposition, regenerated artefacts, and a contract review before approval (pm-dispatch(contract-review): a seat sends a PR to the maintainer for approval only after a contract PASS on the current head, and a PR that landed still owing one is re-reviewed after landing, with each finding filed as a new card #27345).bug,pm:blocked.Generated by Claude Code
objectstack-fleet commentedon Oct 30, 2026
domain:spec#4 · marchtian · session_017ihL2fi9zfJhUTubyJYb6V
Note for whoever takes this card · 2026-10-30T02:44Z · ⛔ not a claim. Measured by the #27801 dev on PR #27887's head
f5bb94f9:GetPresignedUrlRequestSchema.filenameand.mimeType(packages/spec/src/api/storage.zod.ts:67–68) are barez.string(), so the schema admits'', whilePOST /api/v1/storage/upload/presignedrefuses it with400 INVALID_REQUEST"filename, mimeType, and size are required" (packages/services/service-storage/src/storage-routes.ts:968–969). That door does not parse its body with the schema. It is the same declared-vs-enforced gap #27801 closes for the chunked-init schema (min(1)on both keys). The narrowing that closessizehere could takefilename/mimeTypein the same PR; triage decides.