From 7762d7746e2a1815e9c7c30fd4525e970265ecbb Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 3 Aug 2025 20:36:15 +0000
Subject: [PATCH] fix: make user data export download return 404 for
 nonexistent files  (#1227)

---
 pkg/routes/api/v1/user_export.go          | 14 +++++++
 pkg/webtests/user_export_download_test.go | 49 +++++++++++++++++++++++
 2 files changed, 63 insertions(+)
 create mode 100644 pkg/webtests/user_export_download_test.go

diff --git a/pkg/routes/api/v1/user_export.go b/pkg/routes/api/v1/user_export.go
index a1fec1e91..807c8a66e 100644
--- a/pkg/routes/api/v1/user_export.go
+++ b/pkg/routes/api/v1/user_export.go
@@ -18,6 +18,7 @@ package v1
 
 import (
 	"net/http"
+	"os"
 	"time"
 
 	"code.vikunja.io/api/pkg/db"
@@ -112,6 +113,7 @@ func RequestUserDataExport(c echo.Context) error {
 // @Param password body v1.UserPasswordConfirmation true "User password to confirm the download."
 // @Success 200 {object} models.Message
 // @Failure 400 {object} web.HTTPError "Something's invalid."
+// @Failure 404 {object} web.HTTPError "No user data export found."
 // @Failure 500 {object} models.Message "Internal server error."
 // @Router /user/export/download [post]
 func DownloadUserDataExport(c echo.Context) error {
@@ -126,14 +128,26 @@ func DownloadUserDataExport(c echo.Context) error {
 		return handler.HandleHTTPError(err)
 	}
 
+	// Check if user has an export file
+	exportNotFoundError := echo.NewHTTPError(http.StatusNotFound, "No user data export found.")
+	if u.ExportFileID == 0 {
+		return exportNotFoundError
+	}
+
 	// Download
 	exportFile := &files.File{ID: u.ExportFileID}
 	err = exportFile.LoadFileMetaByID()
 	if err != nil {
+		if files.IsErrFileDoesNotExist(err) {
+			return exportNotFoundError
+		}
 		return handler.HandleHTTPError(err)
 	}
 	err = exportFile.LoadFileByID()
 	if err != nil {
+		if os.IsNotExist(err) {
+			return exportNotFoundError
+		}
 		return handler.HandleHTTPError(err)
 	}
 
diff --git a/pkg/webtests/user_export_download_test.go b/pkg/webtests/user_export_download_test.go
new file mode 100644
index 000000000..a51b1b061
--- /dev/null
+++ b/pkg/webtests/user_export_download_test.go
@@ -0,0 +1,49 @@
+// Vikunja is a to-do list application to facilitate your life.
+// Copyright 2018-present Vikunja and contributors. All rights reserved.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package webtests
+
+import (
+	"net/http"
+	"testing"
+
+	apiv1 "code.vikunja.io/api/pkg/routes/api/v1"
+
+	"github.com/labstack/echo/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUserExportDownload(t *testing.T) {
+	t.Run("no export file", func(t *testing.T) {
+		// Use testuser15 which has no export file (ExportFileID = 0)
+		body := `{"password": "12345678"}`
+		_, err := newTestRequestWithUser(t, http.MethodPost, apiv1.DownloadUserDataExport, &testuser15, body, nil, nil)
+		require.Error(t, err)
+		assert.Equal(t, http.StatusNotFound, err.(*echo.HTTPError).Code)
+		assert.Contains(t, err.(*echo.HTTPError).Message, "No user data export found")
+	})
+
+	t.Run("export file metadata exists but physical file does not exist", func(t *testing.T) {
+		// Use testuser1 which has export_file_id = 1, and file metadata exists but physical file doesn't exist
+		body := `{"password": "12345678"}`
+		_, err := newTestRequestWithUser(t, http.MethodPost, apiv1.DownloadUserDataExport, &testuser1, body, nil, nil)
+		require.Error(t, err)
+		// This should return 404 when the physical file doesn't exist
+		assert.Equal(t, http.StatusNotFound, err.(*echo.HTTPError).Code)
+		assert.Contains(t, err.(*echo.HTTPError).Message, "No user data export found")
+	})
+}