fix(resources,flowfiles): propagate zip Close() error instead of swallowing it

The four Zip* builders deferred zw.Close() with an unnamed return, dropping the
error from the central-directory flush. After the resources download moved to
direct socket streaming, a dropped connection during that final flush could
return a truncated archive under HTTP 200. Capture Close() via a named return so
streamZipArchive logs and aborts the partial response. Regression tests in both
packages drive the Close() error path with a failing writer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: sirozha

backend/pkg/flowfiles/files.go

@@ -430,9 +430,13 @@ func ExtractTar(r io.Reader, destDir string) error {
 	return nil
 }
 
-func ZipDirectory(w io.Writer, dirPath string) error {
+func ZipDirectory(w io.Writer, dirPath string) (err error) {
 	zw := zip.NewWriter(w)
-	defer zw.Close()
+	defer func() {
+		if cerr := zw.Close(); err == nil {
+			err = cerr
+		}
+	}()
 
 	return filepath.WalkDir(dirPath, func(entryPath string, d fs.DirEntry, err error) error {
 		if err != nil {
@@ -469,9 +473,13 @@ func ZipDirectory(w io.Writer, dirPath string) error {
 //
 // The caller is responsible for deduplicating relPaths before calling this
 // function; no internal deduplication of ZIP entry names is performed.
-func ZipRelativePaths(w io.Writer, baseDir string, relPaths []string) error {
+func ZipRelativePaths(w io.Writer, baseDir string, relPaths []string) (err error) {
 	zw := zip.NewWriter(w)
-	defer zw.Close()
+	defer func() {
+		if cerr := zw.Close(); err == nil {
+			err = cerr
+		}
+	}()
 
 	for _, relPath := range relPaths {
 		localPath := filepath.Join(baseDir, filepath.FromSlash(relPath))

backend/pkg/flowfiles/files_test.go

@@ -4,6 +4,7 @@ import (
 	"archive/tar"
 	"archive/zip"
 	"bytes"
+	"errors"
 	"io"
 	"mime/multipart"
 	"net/http/httptest"
@@ -17,6 +18,21 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+type errWriter struct{}
+
+func (errWriter) Write([]byte) (int, error) { return 0, errors.New("write failed") }
+
+// Empty inputs route every write through zip.Writer.Close()'s central-directory
+// flush, so a failing writer here exercises exactly the Close() error path that
+// must surface instead of being dropped as a success.
+func TestZipDirectoryPropagatesCloseError(t *testing.T) {
+	require.Error(t, ZipDirectory(errWriter{}, t.TempDir()))
+}
+
+func TestZipRelativePathsPropagatesCloseError(t *testing.T) {
+	require.Error(t, ZipRelativePaths(errWriter{}, t.TempDir(), nil))
+}
+
 type tarTestEntry struct {
 	name     string
 	typeflag byte

backend/pkg/resources/resources.go

@@ -322,9 +322,13 @@ func CommitBlob(dataDir, hash, tmpPath string) error {
 
 // ZipResources writes a ZIP archive to w containing all entries in files.
 // Each ZipEntry maps a .blob file on disk to a path inside the archive.
-func ZipResources(w io.Writer, entries []ZipEntry) error {
+func ZipResources(w io.Writer, entries []ZipEntry) (err error) {
 	zw := zip.NewWriter(w)
-	defer zw.Close()
+	defer func() {
+		if cerr := zw.Close(); err == nil {
+			err = cerr
+		}
+	}()
 
 	for _, e := range entries {
 		info, err := os.Lstat(e.BlobPath)
@@ -367,9 +371,13 @@ func ZipResources(w io.Writer, entries []ZipEntry) error {
 // ZipDirectory is kept for symmetry with flowfiles and wraps ZipResources by
 // walking a real FS directory.  In the resources service, use ZipResources
 // instead since files are stored as blobs, not in a directory structure.
-func ZipDirectory(w io.Writer, dirPath string) error {
+func ZipDirectory(w io.Writer, dirPath string) (err error) {
 	zw := zip.NewWriter(w)
-	defer zw.Close()
+	defer func() {
+		if cerr := zw.Close(); err == nil {
+			err = cerr
+		}
+	}()
 
 	return filepath.WalkDir(dirPath, func(entryPath string, d fs.DirEntry, err error) error {
 		if err != nil {

backend/pkg/resources/resources_test.go

@@ -5,6 +5,7 @@ import (
 	"bytes"
 	"crypto/md5"
 	"encoding/hex"
+	"errors"
 	"io"
 	"os"
 	"path/filepath"
@@ -15,6 +16,21 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+type errWriter struct{}
+
+func (errWriter) Write([]byte) (int, error) { return 0, errors.New("write failed") }
+
+// With no entries, the only bytes written to w happen during zip.Writer.Close()'s
+// final central-directory flush, so a failing writer here exercises exactly the
+// Close() error path that must surface instead of being dropped as a success.
+func TestZipResourcesPropagatesCloseError(t *testing.T) {
+	require.Error(t, ZipResources(errWriter{}, nil))
+}
+
+func TestZipDirectoryPropagatesCloseError(t *testing.T) {
+	require.Error(t, ZipDirectory(errWriter{}, t.TempDir()))
+}
+
 func TestResourceDirsAndBlobPath(t *testing.T) {
 	assert.Equal(t, "/data/resources", ResourcesDir("/data"))
 	assert.Equal(t, "/data/resources/900150983cd24fb0d6963f7d28e17f72.blob",