Preserve private asset metadata headers and verify cross-project adoption

.gitea/workflows/check.yml

@@ -71,7 +71,7 @@ jobs:
           PYSLACK
       - name: Fetch pinned headless HTTP integration client
         env:
-          HEADLESS_CLIENT_REVISION: a294c6ca41d082230734f78320dcbf38985c2ee9
+          HEADLESS_CLIENT_REVISION: a626e6c3006765ae5569b40cf7d48b7f263a722a
         run: |
           set -eu
           mkdir -p .headless-client

internal/platform/assets.go

@@ -312,7 +312,9 @@ func (s *service) getAssetMetadata(w http.ResponseWriter, r *http.Request, proje
 	}
 	info.URL = s.assetURL(project, workspace, id)
 	w.Header().Set("Cache-Control", "private, no-store")
-	reply(w, 200, response{"metadata_version": 1, "asset": info, "sha256": digest})
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	_ = json.NewEncoder(w).Encode(response{"metadata_version": 1, "asset": info, "sha256": digest})
 	return nil
 }
 

internal/platform/integration_test.go

@@ -603,9 +603,12 @@ func TestOnboardingAndSharing(t *testing.T) {
 				t.Fatal(err)
 			}
 			digest := sha256.Sum256(assetPNG.Bytes())
-			if metadata["metadata_version"] != float64(1) || metadata["sha256"] != hex.EncodeToString(digest[:]) || !modelEqual(metadata["asset"], uploaded) || result.Header().Get("Cache-Control") != "private, no-store" {
+			if metadata["metadata_version"] != float64(1) || metadata["sha256"] != hex.EncodeToString(digest[:]) || !modelEqual(metadata["asset"], uploaded) {
 				t.Fatalf("invalid metadata identity: %s", result.Body.String())
 			}
+			if result.Header().Get("Cache-Control") != "private, no-store" {
+				t.Fatalf("invalid metadata privacy header: %q", result.Header().Get("Cache-Control"))
+			}
 		}
 	}
 	// Neither a snapshot nor an asset response may keep the workspace locked