Fix feed version by ID download

[irees]

Summary

Fixes the feed version download REST endpoints so they work when given an integer database ID instead of a string key. Both /feed_versions/{key}/download and /feeds/{key}/download_latest_feed_version already branch on whether the path parameter parses as an integer, sending it as the GraphQL ids variable instead of the sha1/onestop_id key — but the integer path was broken in two ways, so downloads by ID always failed.

GraphQL variable nullability

The lookup queries declared their key variables as non-nullable ($feed_version_sha1: String!, $feed_onestop_id: String!). When downloading by integer ID the handler leaves those variables unset, which fails GraphQL validation before the query ever runs. Both are now nullable (String), so a request that supplies only ids is valid.

Found-check no longer assumes the key is the sha1

feedVersionDownloadHandler decided a feed version was found by comparing the returned sha1 against the request key (fvsha1 == key). That holds when the caller passes a sha1, but never when the caller passes an integer ID, so the handler returned 404 for valid IDs. It now treats the lookup as found whenever the query returns a non-empty sha1 (fvsha1 != ""). The latest-feed-version handler already used a gjson existence check and only needed the nullability fix.

Tests

Adds a resolveID helper that posts a GraphQL query as admin and extracts an id via gjson, since fixture serial ids are not stable across runs. New subtests in TestFeedVersionDownloadRequest and TestFeedDownloadLatestRequest resolve the feed version / feed id, hit the download endpoints by integer id, and assert a 200 with the expected 59324-byte body.

Test plan

• Resolve a feed version id via GraphQL and GET /feed_versions/{id}/download as admin; confirm a 200 and the full GTFS zip body.
• Resolve a feed id via GraphQL and GET /feeds/{id}/download_latest_feed_version as admin; confirm a 200 and the full zip body.
• Confirm the existing string-key paths (sha1 for feed versions, onestop_id for feeds) still download, and that anonymous requests to a redistribution-restricted feed remain unauthorized.

[Copilot]

Pull request overview

This PR fixes the REST feed-version download endpoints to support integer database IDs (in addition to existing string keys) by correcting GraphQL query variable nullability and adjusting the “found” check logic for feed-version lookups.

Changes:

• Make $feed_onestop_id / $feed_version_sha1 GraphQL variables nullable so requests that only supply ids pass GraphQL validation.
• Fix feedVersionDownloadHandler to treat a feed version as found when the lookup returns a non-empty sha1 (instead of comparing sha1 to the request key).
• Add tests that resolve stable IDs via GraphQL at runtime and exercise both download endpoints using integer IDs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
server/rest/feed_version_download.go	Makes GraphQL query variables nullable and fixes feed-version “found” logic so integer-ID download paths work.
server/rest/feed_version_download_test.go	Adds a GraphQL-based ID resolver helper and new subtests to validate downloading by integer ID.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.