agent-code-review/freno-dev
1
0
Fork 0
forked from Mike/freno-dev
Code Pull Requests Activity

downloads: serve Nook delta files the Sparkle updater fetches

Browse Source 
The v0.10.0 publish stopped at the enclosure check: the appcast names
Nook17-9.delta / Nook17-10.delta, and the proxy 400'd both with
'Invalid file format' while the TheNook DMG passed. Sparkle names delta
files after the app bundle, not the DMG, so the prefix allowlist needs
'Nook' alongside 'TheNook'. Both deltas sat in S3 the whole time; the
appcast was never published and the live one still serves 0.9.0.

Adds a static source-audit regression test in the repo's downloads.test
pattern; proven red against the unfixed allowlist.

Tests: bun test src/routes/api/downloads/filename.test.ts

NOOK-337

Co-Authored-By: glm-5.3-flash <noreply@neuralwatt.com>
This commit is contained in:
Michael Freno
2026-10-13 22:17:27 -04:00
parent 6898186df5
commit 1a182e53fe
2 changed files with 43 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/routes/api/downloads/[filename].ts
View File

@@ -8,7 +8,10 @@ import { env } from "~/env/server";
*
* Handles:
* - Full DMG files: /api/downloads/Gaze-0.2.2.dmg, /api/downloads/InputHalo-0.1.0.dmg
* - Delta updates: /api/downloads/Gaze3-2.delta, /api/downloads/InputHalo3-2.delta
* - Delta updates: /api/downloads/Gaze3-2.delta, /api/downloads/Nook17-9.delta
*
* The Nook delta files are named after the app bundle ("Nook"), not the DMG
* ("TheNook"), so both prefixes must be allowed (NOOK-337).
*
* URL: https://freno.me/api/downloads/[filename]
*/
@@ -24,7 +27,7 @@ export async function GET(event: APIEvent) {
});
}
const validPrefixes = ["Gaze", "InputHalo", "TheNook"];
const validPrefixes = ["Gaze", "InputHalo", "TheNook", "Nook"];
const isValidPrefix = validPrefixes.some((prefix) => filename.startsWith(prefix));
if (
!isValidPrefix ||