# test630 — file download header-only authentication

Date: 2026-08-09
Issue: #501 (query-token half)
Source commit: d512d8881a5686f27adaa3920370993940ed9490
Docker tag: anet-test630:dev
Docker image: sha256:dc4990b3223edd1e49fc580fe32c017b6e202934acfa8602db3b97ba607c137f
Embedded source: TEST630_SOURCE_COMMIT=d512d8881a5686f27adaa3920370993940ed9490
Runner artifact SHA256: daa0d23832b5eb1acd1e2a41e97ef956224230289f45859cb8952df461836b0c

## Result

- Real Hub file authorization suite: 20 pass / 0 fail / 50 assertions.
- A valid user token in `?token=` is rejected with 401 for both file `GET`
  and `HEAD`.
- The same tokens remain valid in `Authorization: Bearer ...` headers.
- Existing owner, same-network member, cross-network denial, node-token,
  legacy-master, admin, null-owner, unknown-file and HEAD parity cases remain
  green.
- Only `/api/files/:file_id` opts out of query-token authentication. The
  existing compatibility path remains available to SSE/EventSource and other
  routes pending a separate migration.
- Witnessed red: removing both file-route opt-outs makes the new GET and HEAD
  tests fail (rc=1); restoring them returns 20/0/50.

```text
L0 production file authorization suite
20 pass
0 fail
50 expect() calls
MUTATION_RED: file-query-token-opt-out rc=1
L2 restored green
20 pass
0 fail
50 expect() calls
RESULT: PASS
```

## Scope note: global admin

This candidate does not change the second policy question in #501. Since
#500/#503, cross-network `admin-utok` access is no longer an accidental direct
read of `users.role`: `resolvePrincipal` classifies the credential and
`authorizeFileDownload` explicitly grants global-admin operational access,
while an admin-issued `ntok` is classified as a network token first and cannot
cross its bound network. Changing the remaining global-admin grant is an API
semantics decision and needs a separate design/rollout door.

No production service, database, credential, global package, or deployment was
touched.
