Relay transfers uncached when no staging file can be opened

[matt-edmondson]

Fixes #57

What was wrong

Both object paths in ObjectRouteHandler called store.OpenStaging(...) with no error handling. OpenStaging runs Directory.CreateDirectory and FileStream.New(..., FileMode.CreateNew, ...), and the startup writability probe only runs once.

So if the store stopped accepting writes later, every pull miss and every push failed with a 500, even though upstream was healthy. Causes include a permissions change, a read-only remount, inode exhaustion, or a stray file at {root}/{upstream}/staging.

On a download, upstream's status and headers had already been copied to the response when the exception escaped.

Change

• New ObjectRouteHandler.TryOpenStaging catches IOException, UnauthorizedAccessException and ArgumentException from OpenStaging, which are the three the issue lists. On failure it:
  • logs StagingUnavailable (event 2012, warning) with the exception, oid and upstream;
  • increments a new counter, gitlfscache.staging_failures, tagged by upstream;
  • returns null.
• Download miss: when there is no staging file, the object is streamed from upstream to the client without storing it. This uses the same branch that range requests already take.
• Upload: when there is no staging file, the body is still relayed to upstream through ReadTeeStream with Stream.Null as the sink, so RecordUpload still reports the relayed byte count. Nothing is published.

One interaction to be aware of: catching ArgumentException also covers the invalid-upstream-key throw in OpenStaging. That is the symptom described in #56, where a dot in the upstream key gives a 500 on every object transfer. After this change those transfers succeed uncached, and each one logs a warning and counts a staging failure, instead of returning 500. #56 still needs its own fix so those objects can be cached.

Tests

Two new integration tests in ProxyFlowTests. Each puts a file where {root}/github/staging belongs, following the repro in the issue:

• Download_StagingCannotBeOpened_IsServedFromUpstreamWithoutCaching: the client gets 200 with the full object, upstream is fetched once, nothing is stored, and the metric is 1.
• Upload_StagingCannotBeOpened_IsStillRelayedUpstream: the client gets 200, upstream receives the bytes, nothing is stored, and the metric is 1.

Checked both directions:

• With TryOpenStaging reduced to a bare store.OpenStaging(upstream), both tests fail.
• With the fix, the full suite passes: 332/332.

🤖 Generated with Claude Code

https://claude.ai/code/session_015u9u95HXjY2mDagnzGzxK2

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
5 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud