Merge remote-tracking branch 'origin/main' into armorer/fs-http-timeout-surface

Author: Goosterhof

packages/http/src/http.ts

@@ -27,6 +27,12 @@ const HEADERS_TO_TYPE: Record<string, string> = {
  */
 export const DEFAULT_TIMEOUT_MS = 30_000;
 
+// axios 1.15+ types `response.headers[key]` as `AxiosHeaderValue | undefined`
+// (string | string[] | number | boolean | null | AxiosHeaders | undefined). For
+// content-type handling we only honor a real string; any other shape falls back
+// to undefined so the consumer's default applies.
+const asString = (value: unknown): string | undefined => (typeof value === 'string' ? value : undefined);
+
 const unregister = <T>(array: T[], item: T): UnregisterMiddleware => {
     return () => {
         const index = array.indexOf(item);
@@ -109,7 +115,7 @@ export const createHttpService = (baseURL: string, options?: HttpServiceOptions)
         const response = await http.get(endpoint, {responseType: 'blob'});
         const {data, headers} = response;
 
-        const actualType = getContentType(headers['content-type'], type);
+        const actualType = getContentType(asString(headers['content-type']), type);
 
         const blob = new Blob([data], {type: actualType});
         const link = document.createElement('a');
@@ -126,7 +132,7 @@ export const createHttpService = (baseURL: string, options?: HttpServiceOptions)
 
     const previewRequest = async (endpoint: string): Promise<string> => {
         const response = await http.get(endpoint, {responseType: 'blob'});
-        const contentType: string = response.headers['content-type'] ?? 'application/octet-stream';
+        const contentType = asString(response.headers['content-type']) ?? 'application/octet-stream';
         const blob = new Blob([response.data], {type: contentType});
 
         return window.URL.createObjectURL(blob);

packages/http/tests/http.spec.ts

@@ -532,6 +532,17 @@ describe('createHttpService', () => {
             );
         });
 
+        it('throws when content-type header is non-string (axios 1.15+ AxiosHeaderValue)', async () => {
+            // Arrange — axios 1.15+ types header values as
+            // `AxiosHeaders | string | string[] | number | boolean | null`. Non-string values
+            // fall through `asString` to undefined, hitting the same path as a missing header.
+            mock.onGet(`${BASE_URL}/download/odd`).reply(200, 'data', {'content-type': null as unknown as string});
+            const service = createHttpService(BASE_URL);
+
+            // Act & Assert
+            await expect(service.downloadRequest('/download/odd', 'file.bin')).rejects.toThrow('No content type found');
+        });
+
         it('revokes the object URL after triggering the download', async () => {
             // Arrange
             mock.onGet(`${BASE_URL}/download/file.pdf`).reply(200, 'file-content', {'content-type': 'application/pdf'});
@@ -577,6 +588,22 @@ describe('createHttpService', () => {
             const BlobMock = globalThis.Blob as unknown as ReturnType<typeof vi.fn>;
             expect(BlobMock).toHaveBeenCalledWith(['blob-data'], {type: 'application/octet-stream'});
         });
+
+        it('uses fallback content type when header is non-string (axios 1.15+ AxiosHeaderValue)', async () => {
+            // Arrange — axios 1.15+ types header values as a union including arrays, numbers,
+            // booleans, and null. Any non-string value falls through `asString` and hits the
+            // same fallback path as a missing header.
+            mock.onGet(`${BASE_URL}/preview/doc`).reply(200, 'blob-data', {'content-type': null as unknown as string});
+            const service = createHttpService(BASE_URL);
+
+            // Act
+            const url = await service.previewRequest('/preview/doc');
+
+            // Assert
+            expect(url).toBe('blob:http://localhost/fake-object-url');
+            const BlobMock = globalThis.Blob as unknown as ReturnType<typeof vi.fn>;
+            expect(BlobMock).toHaveBeenCalledWith(['blob-data'], {type: 'application/octet-stream'});
+        });
     });
 
     describe('streamRequest', () => {