From ebc74f4abe7f988c85d1cde2e6493d2d3960e9ab Mon Sep 17 00:00:00 2001 From: curo1305 Date: Tue, 23 Jun 2026 00:26:23 +0200 Subject: [PATCH] fix(13): CR-06 re-raise HTTPException in preview_cloud_file instead of masking as unsupported_preview --- backend/api/cloud/operations.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/backend/api/cloud/operations.py b/backend/api/cloud/operations.py index 7e3bb51..9b33d5a 100644 --- a/backend/api/cloud/operations.py +++ b/backend/api/cloud/operations.py @@ -293,9 +293,10 @@ async def preview_cloud_file( conn, adapter = await _resolve_and_get_adapter(session, connection_id, current_user.id) file_bytes = await adapter.get_object(item_id) except HTTPException: - # Re-raise 404 from ownership check in _resolve_and_get_adapter (already done above, - # but keep for belt-and-suspenders) - return _unsupported_preview_response(connection_id, item_id, "provider_error") + # Re-raise 401 (credential failure) and 404 (ownership race) — never mask as + # unsupported_preview. The IDOR guard in Step 1 already passed, but a 401 + # from credential decryption should surface as an auth error to the client. + raise except Exception: return _unsupported_preview_response(connection_id, item_id, "provider_error")