Classify missing release IDs when accessing assets

internal/gitea/backend.go

@@ -114,9 +114,9 @@ func (b *Backend) CreateRelease(ctx context.Context, request forge.CreateRelease
 }
 
 func (b *Backend) UploadAsset(ctx context.Context, handle any, filename string, content io.Reader) (forge.WriteEvidence, error) {
-	release, ok := handle.(releaseHandle)
-	if !ok || release.id <= 0 {
-		return forge.WriteEvidence{Disposition: forge.WriteNotAttempted}, &forge.Failure{Kind: forge.FailureInvalid, Err: errors.New("release handle was not created by the Gitea backend")}
+	release, err := assetReleaseHandle(handle)
+	if err != nil {
+		return forge.WriteEvidence{Disposition: forge.WriteNotAttempted}, err
 	}
 	if strings.TrimSpace(filename) == "" || content == nil {
 		return forge.WriteEvidence{Disposition: forge.WriteNotAttempted}, &forge.Failure{Kind: forge.FailureInvalid, Err: errors.New("asset filename and content reader are required")}
@@ -239,9 +239,9 @@ func (b *Backend) FindRelease(ctx context.Context, tag string) (forge.Release, e
 }
 
 func (b *Backend) ListAssets(ctx context.Context, handle any) ([]forge.Asset, error) {
-	release, ok := handle.(releaseHandle)
-	if !ok {
-		return nil, &forge.Failure{Kind: forge.FailureInvalid, Err: errors.New("release handle was not created by the Gitea backend")}
+	release, err := assetReleaseHandle(handle)
+	if err != nil {
+		return nil, err
 	}
 	_, apiRoot, err := b.destinationAPI("list release assets")
 	if err != nil {
@@ -262,6 +262,17 @@ func (b *Backend) ListAssets(ctx context.Context, handle any) ([]forge.Asset, er
 	return assets, nil
 }
 
+func assetReleaseHandle(handle any) (releaseHandle, error) {
+	release, ok := handle.(releaseHandle)
+	if !ok {
+		return releaseHandle{}, &forge.Failure{Kind: forge.FailureInvalid, Err: errors.New("release handle was not created by the Gitea backend")}
+	}
+	if release.id <= 0 {
+		return releaseHandle{}, &forge.Failure{Kind: forge.FailureMalformed, Err: errors.New("release response does not contain a positive release ID")}
+	}
+	return release, nil
+}
+
 func (b *Backend) OpenAsset(ctx context.Context, handle any) (io.ReadCloser, error) {
 	asset, ok := handle.(assetHandle)
 	if !ok {

internal/gitea/backend_test.go

@@ -64,6 +64,70 @@ func TestBackendFindReleaseDoesNotRequireWriteResponseFields(t *testing.T) {
 	}
 }
 
+func TestBackendAssetOperationsRequireObservedReleaseID(t *testing.T) {
+	for _, tc := range []struct {
+		name, body string
+		valid      bool
+	}{
+		{"missing", `{"tag_name":"v1.2.3"}`, false},
+		{"zero", `{"id":0,"tag_name":"v1.2.3"}`, false},
+		{"negative", `{"id":-1,"tag_name":"v1.2.3"}`, false},
+		{"valid", `{"id":12,"tag_name":"v1.2.3"}`, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			requests := 0
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if strings.Contains(r.URL.Path, "/releases/tags/") {
+					_, _ = io.WriteString(w, tc.body)
+					return
+				}
+				requests++
+				if r.Method == http.MethodGet {
+					_, _ = io.WriteString(w, `[]`)
+					return
+				}
+				w.WriteHeader(http.StatusCreated)
+				_, _ = io.WriteString(w, `{"id":1,"name":"file"}`)
+			}))
+			defer server.Close()
+			backend := NewBackend(testDestination(server.URL), server.Client())
+			release, err := backend.FindRelease(context.Background(), "v1.2.3")
+			if err != nil {
+				t.Fatal(err)
+			}
+			_, listErr := backend.ListAssets(context.Background(), release.Handle)
+			evidence, uploadErr := backend.UploadAsset(context.Background(), release.Handle, "file", strings.NewReader("data"))
+			if tc.valid {
+				if listErr != nil || uploadErr != nil || requests != 2 {
+					t.Fatalf("valid: list %v, upload %v, requests %d", listErr, uploadErr, requests)
+				}
+				return
+			}
+			for _, err := range []error{listErr, uploadErr} {
+				var failure *forge.Failure
+				if !errors.As(err, &failure) || failure.Kind != forge.FailureMalformed {
+					t.Fatalf("failure = %v", err)
+				}
+			}
+			if requests != 0 || evidence.Attempted || evidence.Disposition != forge.WriteNotAttempted {
+				t.Fatalf("requests = %d, evidence = %#v", requests, evidence)
+			}
+		})
+	}
+	backend := NewBackend(Destination{}, nil)
+	_, listErr := backend.ListAssets(context.Background(), "wrong")
+	evidence, uploadErr := backend.UploadAsset(context.Background(), "wrong", "file", strings.NewReader("data"))
+	for _, err := range []error{listErr, uploadErr} {
+		var failure *forge.Failure
+		if !errors.As(err, &failure) || failure.Kind != forge.FailureInvalid {
+			t.Fatalf("wrong handle failure = %v", err)
+		}
+	}
+	if evidence.Attempted || evidence.Disposition != forge.WriteNotAttempted {
+		t.Fatalf("wrong handle evidence = %#v", evidence)
+	}
+}
+
 func TestBackendListsMetadataAndOpensCallerOwnedAssetStream(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if got, want := r.Header.Get("Authorization"), "token fixture-secret-token"; got != want {