Get a signed token for downloading a backup file.
(request, filename)
| 128 | @api_view(["GET"]) |
| 129 | @permission_classes([IsAdmin]) |
| 130 | def get_download_token(request, filename): |
| 131 | """Get a signed token for downloading a backup file.""" |
| 132 | try: |
| 133 | # Security: prevent path traversal |
| 134 | if ".." in filename or "/" in filename or "\\" in filename: |
| 135 | raise Http404("Invalid filename") |
| 136 | |
| 137 | backup_dir = services.get_backup_dir() |
| 138 | backup_file = backup_dir / filename |
| 139 | |
| 140 | if not backup_file.exists(): |
| 141 | raise Http404("Backup file not found") |
| 142 | |
| 143 | token = _generate_task_token(filename) |
| 144 | return Response({"token": token}) |
| 145 | except Http404: |
| 146 | raise |
| 147 | except Exception as e: |
| 148 | return Response( |
| 149 | {"detail": f"Failed to generate token: {str(e)}"}, |
| 150 | status=status.HTTP_500_INTERNAL_SERVER_ERROR, |
| 151 | ) |
| 152 | |
| 153 | |
| 154 | @api_view(["GET"]) |
nothing calls this directly
no test coverage detected