Status. Proposed design only. Nothing in this vault is GGA client approval. The GGA client documents are supplied drafts: see GGA-Source-Digest. No application, service or test has been executed; every scenario is Not executed. Delivery fees and dates are open.
GS18 · File upload, scanning and download control
| Field | Value |
|---|---|
| Status | Not executed |
| Type | Balanced software (new in the GGA baseline) |
| Source | Blueprint pp. 14, 17 (GGA-Requirement-Register); client-supplied draft, not accepted |
| Gate | GA10 |
| Blueprint delivery stage | Stage 3 Complete the service loop (p. 19) |
| Build step | 02 (primary; tests first) |
| Replaces or carries | T11 |
| Decisions | GL07-staged |
Given
Evidence uploads: an allowed file, a disallowed type, an executable renamed as a document, an oversize file and a file not yet scanned.
When
Upload each; request a share and a download as owner, grantee, expired grantee and stranger; use a guessed storage key.
Then / oracle
Unscanned or disallowed files cannot be shared. File type is validated by content, not extension; executables are blocked and sizes are limited; displayed text is sanitised. Downloads check owner or grantee, resource version, scan state and grant expiry, and are served through an authorised handler or short-lived link. Storage keys are never exposed.
Evidence required
Per-case refusal; scan state transitions; download log; no storage key in any response.
Decision dependency
- GL07-staged: The file-scanning provider is a launch decision; the scenario uses a stub scanner port
Where a decision is pending, the dependent assertion is Blocked by that decision and no oracle is invented. A proposed default is a configuration value, not a promise. This note is a specification: it is Passed only on a named integrated build and fixture.
Back to GGA-Scenario-Index · GGA-Traceability-Matrix · Scenario-Dispositions.