Guard attachment paths against nil work-package links

validateAttachment and upload dereferenced WorkPackageDto.Links without
a nil check, so a server payload lacking _links, or a work package
re-fetched after a custom action that dropped the addAttachment link,
panicked the CLI. Convert() was already hardened for nil Links; make
both attachment paths agree by returning a handled error instead.

Author: myabc

components/resources/work_packages/attachment_guard_test.go

@@ -0,0 +1,32 @@
+package work_packages
+
+import (
+	"testing"
+
+	"github.com/opf/openproject-cli/dtos"
+)
+
+// A work package whose payload has no _links object must not panic the
+// attachment validation; it should be reported as not accepting attachments.
+func TestValidateAttachmentNilLinks(t *testing.T) {
+	err := validateAttachment(&dtos.WorkPackageDto{Links: nil}, "irrelevant")
+	if err == nil {
+		t.Fatal("validateAttachment(nil Links) = nil, want error")
+	}
+}
+
+// upload must self-guard: the work package may be re-fetched after a custom
+// action, dropping the addAttachment link that validateAttachment saw earlier.
+func TestUploadNilAddAttachment(t *testing.T) {
+	cases := map[string]*dtos.WorkPackageDto{
+		"nil links":          {Links: nil},
+		"nil add attachment": {Links: &dtos.WorkPackageLinksDto{}},
+	}
+	for name, dto := range cases {
+		t.Run(name, func(t *testing.T) {
+			if err := upload(dto, "irrelevant"); err == nil {
+				t.Errorf("upload(%s) = nil, want error", name)
+			}
+		})
+	}
+}

components/resources/work_packages/update.go

@@ -143,6 +143,9 @@ func executePatch(workPackage, patchDto *dtos.WorkPackageDto, updateString strin
 }
 
 func validateAttachment(workPackage *dtos.WorkPackageDto, path string) error {
+	if workPackage.Links == nil {
+		return fmt.Errorf("this work package does not accept attachments (missing permission?)")
+	}
 	if workPackage.Links.PrepareAttachment != nil {
 		return fmt.Errorf("uploads to fog storages are currently not supported")
 	}

components/resources/work_packages/upload.go

@@ -16,6 +16,9 @@ import (
 // upload assumes validateAttachment already confirmed the work package
 // accepts direct uploads (addAttachment link present, no fog storage).
 func upload(dto *dtos.WorkPackageDto, path string) error {
+	if dto.Links == nil || dto.Links.AddAttachment == nil {
+		return fmt.Errorf("work package no longer accepts attachments")
+	}
 	printer.Info(fmt.Sprintf("Uploading %s to work package ...", printer.Yellow(filepath.Base(path))))
 	link := dto.Links.AddAttachment
 	reader, contentType, err := bodyReader(path)