{"record":{"id":"a681dcc541f30159","repo":"Significant-Gravitas/AutoGPT","slug":"not-found-a681dc","errorCode":null,"errorMessage":"Not found","messagePattern":"Not found","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"error","filePath":"autogpt_platform/backend/backend/api/features/v1.py","lineNumber":2385,"sourceCode":"        str,\n        Path(pattern=SHARE_TOKEN_PATTERN),\n    ],\n    file_id: Annotated[\n        str,\n        Path(pattern=SHARE_TOKEN_PATTERN),\n    ],\n) -> Response:\n    \"\"\"Download a workspace file from a shared execution (no auth required).\n\n    Validates that the file was explicitly exposed when sharing was enabled.\n    Returns a uniform 404 for all failure modes to prevent enumeration attacks.\n    \"\"\"\n    # Single-query validation against the allowlist\n    execution_id = await execution_db.get_shared_execution_file(\n        share_token=share_token, file_id=file_id\n    )\n    if not execution_id:\n        raise HTTPException(status_code=404, detail=\"Not found\")\n\n    # Look up the actual file (no workspace scoping needed — the allowlist\n    # already validated that this file belongs to the shared execution)\n    file = await get_workspace_file_by_id(file_id)\n    if not file:\n        raise HTTPException(status_code=404, detail=\"Not found\")\n\n    return await create_file_download_response(file, inline=True)\n\n\n########################################################\n##################### Schedules ########################\n########################################################\n\n\nclass ScheduleCreationRequest(pydantic.BaseModel):\n    graph_version: Optional[int] = None\n    name: str","sourceCodeStart":2367,"sourceCodeEnd":2403,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/backend/backend/api/features/v1.py#L2367-L2403","documentation":"First uniform 404 of the public shared-file download endpoint: the single-query allowlist check `get_shared_execution_file(share_token, file_id)` found no record pairing that file with that share token. The endpoint deliberately returns an identical 'Not found' for every failure mode to prevent token/file enumeration, so this covers wrong file_id, file not exposed when sharing was enabled, and mismatched share_token.","triggerScenarios":"GET /v1/public/shared/{share_token}/files/{file_id}/download where file_id is not in the shared-execution file allowlist for that token — e.g. a workspace file produced after sharing was enabled, a file from a different execution, or a guessed file_id.","commonSituations":"Execution produced new output files after the share was created (only files present in execution.outputs at share time are allowlisted); consumers scraping file IDs from elsewhere in the API; stale links after re-sharing.","solutions":["Only download file IDs that appear in the shared execution's outputs (GET /v1/public/shared/{token} first).","If a newer output file is needed, the owner must disable and re-enable sharing so the allowlist is rebuilt from current outputs.","Do not attempt to enumerate file IDs — every miss returns the same 404 by design."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const shared = await api.getSharedExecution(token);\nconst allowed = new Set(collectFileIds(shared.outputs)); // ids exposed at share time\nif (!allowed.has(fileId)) { show('This file is not part of the shared execution'); return; }","typeGuard":null,"tryCatchPattern":"try {\n  const blob = await api.downloadSharedFile(token, fileId);\n} catch (e) {\n  if (e.status === 404) { show('File not available in this share'); return; }\n  throw e;\n}","preventionTips":["Only expose download links for file IDs present in the shared execution response.","Never probe arbitrary file IDs — responses are uniform 404s by design.","If new outputs must be shared, the owner re-shares to rebuild the allowlist."],"tags":["http-404","anti-enumeration","file-download","sharing","public-endpoint"],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}