fix: backup download blocked by CORS (reply.hijack dropped the headers)

Every /admin/backup/:address request failed in the browser with "No
'Access-Control-Allow-Origin' header is present", despite returning 200
with a perfectly valid zip.

streamUserBackup wrote reply.raw directly behind reply.hijack(). That
skips Fastify's reply lifecycle, and @fastify/cors sets
Access-Control-Allow-Origin through reply.header() -- which is only
flushed to the socket by send(). Hijacking meant those headers were
never written, so the browser blocked a response the server considered
successful. Only the two headers I set by hand on reply.raw survived,
which is why the failure looked like a CORS misconfiguration rather than
a bug in this route.

Hand the archive to Fastify with reply.send(archive) instead. It pipes
the stream just the same, but the reply lifecycle runs, so CORS and any
other plugin headers are flushed normally.

The zip test now asserts access-control-allow-origin on the response.
Confirmed it fails against the hijack version and passes against this
one -- status code alone never proved this route worked from a browser.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: dalmasonto

api/src/__test__/admin-backup-delete.test.ts

@@ -263,7 +263,7 @@ test('the backup route streams a real, importable zip', async (t) => {
     const response = await fastify.inject({
         method: 'GET',
         url: `/admin/backup/${TARGET}`,
-        headers: { nonce: 'test-nonce-admin' },
+        headers: { nonce: 'test-nonce-admin', origin: 'http://localhost:5173' },
     });
 
     t.equal(response.statusCode, 200, 'the backup is served');
@@ -274,6 +274,16 @@ test('the backup route streams a real, importable zip', async (t) => {
         'named after the user it belongs to'
     );
 
+    // Regression: an earlier cut wrote reply.raw behind reply.hijack(), which skips the
+    // reply lifecycle. @fastify/cors sets Access-Control-Allow-Origin via reply.header(),
+    // and those are only flushed by send() -- so the route returned a 200 with a valid
+    // zip that every browser then blocked. Status alone does not prove this route works.
+    t.equal(
+        response.headers['access-control-allow-origin'],
+        'http://localhost:5173',
+        'and carries the CORS header, so a browser will actually surrender the body'
+    );
+
     const zip = await JSZip.loadAsync(response.rawPayload);
 
     const manifestFile = zip.file('aqua.json');

api/src/services/backup_service.ts

@@ -76,29 +76,25 @@ export async function streamUserBackup(
 
     const archive = new ZipArchive({ zlib: { level: 9 } });
 
-    reply.raw.setHeader('Content-Type', 'application/zip');
-    reply.raw.setHeader(
-        'Content-Disposition',
-        `attachment; filename="workspace_${address}.zip"`
-    );
-
-    // We are writing the socket ourselves from here on, so Fastify must not try to
-    // send a reply of its own on top of the stream.
-    reply.hijack();
-    archive.pipe(reply.raw);
-
     archive.on('warning', (err) => Logger.error(`Backup archive warning for ${address}:`, err));
-    archive.on('error', (err) => {
-        Logger.error(`Backup archive error for ${address}:`, err);
-        reply.raw.destroy(err);
-    });
+    archive.on('error', (err) => Logger.error(`Backup archive error for ${address}:`, err));
+
+    // Hand the stream to Fastify rather than writing reply.raw ourselves. Writing raw
+    // (or reply.hijack()) skips the reply lifecycle, and the headers other plugins set
+    // through reply.header() -- @fastify/cors's Access-Control-Allow-Origin above all --
+    // are only flushed to the socket by send(). Bypassing it yields a 200 carrying a
+    // perfectly good zip that the browser then refuses to hand to JS.
+    reply
+        .header('Content-Type', 'application/zip')
+        .header('Content-Disposition', `attachment; filename="workspace_${address}.zip"`)
+        .send(archive);
 
     const nameWithHash: { name: string; hash: string }[] = [];
     const seenAssets = new Set<string>();
 
-    // Past the hijack there is no status code left to send, so nothing in here may
-    // throw: a failure has to tear the socket down, which is what tells the client
-    // the zip it received is truncated rather than handing it a corrupt file.
+    // The response is already streaming, so there is no status code left to send.
+    // Destroying the archive propagates the error through the pipe Fastify set up,
+    // which truncates the download rather than handing the client a corrupt zip.
     try {
         for (const record of latestRecords) {
             try {
@@ -146,8 +142,7 @@ export async function streamUserBackup(
         await archive.finalize();
     } catch (error) {
         Logger.error(`Backup stream failed for ${address}:`, error);
-        archive.destroy();
-        reply.raw.destroy();
+        archive.destroy(error instanceof Error ? error : new Error(String(error)));
     }
 }