[sarwan-1313]

Problem

Four downloaders in the desktop crate call reqwest::get(url).await? (or .send().await?) and write the body to disk without checking the HTTP status. reqwest only errors on transport failures, so a 403/404/5xx (for example an expired signed CDN URL) is saved as if it were the generated file, and the result then flows on as a successful download.

Change

Add .error_for_status()?, as download_url_with_filename already does, at:

• core/utils/download_url_to_temp_dir.rs (download_url_to_temp_dir)
• core/utils/simple_http_download.rs (simple_http_download)
• services/sora/.../handle_successful_generations.rs (download_generation_item)
• services/worldlabs/.../worldlabs_marble_task_polling.rs (download_spz)

Callers already propagate errors with ?, so a bad status now fails the download through the existing error path instead of saving an error page.

Not included

The fal downloader (handle_fal_complete.rs) has the same problem; it is covered by #2550, so I left it out to avoid overlap.

Testing

I could not build or run tests: my environment has no webkit2gtk dev files and no crates.io access. Each change is a one-line addition of a method already used elsewhere in this crate. I have not added a regression test. Happy to add one (for example a local server answering 404) if you want it, and to adjust anything to fit your conventions.

Co-Authored-By: Claude Sonnet 5.5 noreply@anthropic.com

🤖 Generated with Claude Code

https://claude.ai/code/session_01AACSkgJy9tStFUyYW2vy77

[netlify]

❌ Deploy Preview for storyteller-docs failed. Why did it fail? →

Name	Link
🔨 Latest commit	1c41428
🔍 Latest deploy log	https://app.netlify.com/projects/storyteller-docs/deploys/6af00997303b82711a94093f

[eliets2]

First-pass review notes (automated; combined from specialist angles: tests). Please treat as suggestions and verify before acting.

What it does: Adds .error_for_status()? to four desktop downloaders that previously saved the response body without checking the HTTP status, so a non-2xx response such as 403, 404, or 5xx now fails the download through the existing error path instead of being saved as a successful file.

Logical units:

• core/utils/download_url_to_temp_dir.rs — download_url_to_temp_dir
• core/utils/simple_http_download.rs — simple_http_download
• services/sora/.../handle_successful_generations.rs — download_generation_item
• services/worldlabs/.../worldlabs_marble_task_polling.rs — download_spz

Findings:

• [tests] core/utils/download_url_to_temp_dir.rs, download_url_to_temp_dir: no test covers the new error_for_status() behavior; add a test with a local server returning 404/500 asserting an error is returned and no temp file is created, plus a 200 case asserting success.
• [tests] core/utils/simple_http_download.rs, simple_http_download: no test covers non-2xx handling; add a test asserting 403/404/500 returns an error and does not create or overwrite download_path, plus a 200 case asserting the file contents.
• [tests] services/sora/.../handle_successful_generations.rs, download_generation_item: no test covers non-2xx handling for this separate code path; add a test asserting an expired-URL 403/404 returns an error instead of saving the error body as an image.
• [tests] services/worldlabs/.../worldlabs_marble_task_polling.rs, download_spz: no test covers non-2xx handling for this separate code path; add a test asserting 404/500 returns an error and no .spz file is written, plus a 200 case asserting success.

Overlaps: The fal downloader in handle_fal_complete.rs has the same issue but is covered by #2550 and was intentionally left out of this change.

Verdict: needs changes — (1) add non-2xx and 200 tests for download_url_to_temp_dir, (2) add non-2xx and 200 tests for simple_http_download including no create/overwrite on error, (3) add non-2xx tests for the separate Sora and WorldLabs download paths.