fix: temporarily allow WebDAV cleanup in job export/import

When a job export or import passes safety evaluation, the subsequent
WebDAV DELETE (archive cleanup) was still caught by the HTTP middleware's
level check. Now the commands add a temporary rule allowing DELETE on
Impex paths for the duration of the operation.

Also adds SafetyGuard.temporarilyAddRule() for arbitrary temporary rules.

Author: clavery

packages/b2c-cli/src/commands/job/export.ts

@@ -184,6 +184,15 @@ export default class JobExport extends JobCommand<typeof JobExport> {
       } as unknown as SiteArchiveExportResult & {localPath?: string; archiveKept?: boolean};
     }
 
+    // After safety evaluation passes, temporarily allow WebDAV operations
+    // that are part of the export flow (download GET, cleanup DELETE on Impex paths).
+    // Without this, the HTTP middleware would independently block the cleanup DELETE.
+    const cleanupSafetyRule = this.safetyGuard.temporarilyAddRule({
+      method: 'DELETE',
+      path: '**/Impex/**',
+      action: 'allow',
+    });
+
     this.log(
       t('commands.job.export.exporting', 'Exporting data from {{hostname}}...', {
         hostname,
@@ -274,6 +283,8 @@ export default class JobExport extends JobCommand<typeof JobExport> {
         );
       }
       throw error;
+    } finally {
+      cleanupSafetyRule();
     }
   }
 

packages/b2c-cli/src/commands/job/import.ts

@@ -106,6 +106,14 @@ export default class JobImport extends JobCommand<typeof JobImport> {
       } as unknown as SiteArchiveImportResult;
     }
 
+    // After safety evaluation passes, temporarily allow WebDAV operations
+    // that are part of the import flow (upload PUT, cleanup DELETE on Impex paths).
+    const cleanupSafetyRule = this.safetyGuard.temporarilyAddRule({
+      method: 'DELETE',
+      path: '**/Impex/**',
+      action: 'allow',
+    });
+
     if (remote) {
       this.log(
         t('commands.job.import.importingRemote', 'Importing {{target}} from {{hostname}}...', {
@@ -193,6 +201,8 @@ export default class JobImport extends JobCommand<typeof JobImport> {
         );
       }
       throw error;
+    } finally {
+      cleanupSafetyRule();
     }
   }
 }

packages/b2c-tooling-sdk/src/safety/safety-guard.ts

@@ -192,14 +192,27 @@ export class SafetyGuard {
    */
   temporarilyAllow(operation: SafetyOperation): () => void {
     const rule = this.operationToRule(operation);
+    return this.temporarilyAddRule(rule);
+  }
+
+  /**
+   * Add a temporary safety rule for a scoped exemption.
+   *
+   * Unlike {@link temporarilyAllow} which derives a rule from an operation,
+   * this accepts an arbitrary rule — useful for granting broad temporary
+   * access (e.g., allowing WebDAV DELETE on Impex paths during a job export).
+   *
+   * Returns a cleanup function that removes the rule.
+   */
+  temporarilyAddRule(rule: SafetyRule): () => void {
     this.temporaryAllows.push(rule);
-    this.logger.trace({rule}, '[SafetyGuard] Added temporary allow');
+    this.logger.trace({rule}, '[SafetyGuard] Added temporary rule');
 
     return () => {
       const idx = this.temporaryAllows.indexOf(rule);
       if (idx >= 0) {
         this.temporaryAllows.splice(idx, 1);
-        this.logger.trace({rule}, '[SafetyGuard] Removed temporary allow');
+        this.logger.trace({rule}, '[SafetyGuard] Removed temporary rule');
       }
     };
   }