Handle ForbiddenResult and add Disposition to StreamCopyingResultHandler

CHANGELOG.md

@@ -1,4 +1,8 @@
 # Changelog
+## [3.2.0] - 2026-08-20
+### Changes
+- StreamCopyingResultHandler now handles ForbiddenResult<StreamResponse> (403). Previously a forbidden result fell through to the default case and returned 500.
+- StreamResponse gained a Disposition property (default "inline") so callers can force "attachment" for downloads (e.g. zips) while PDFs and similar keep previewing inline.
 ## [3.0.0] - 2026-05-12
 ### Changes
 - Updated to .NET 10

Linn.Common.Service.sln

@@ -1,7 +1,7 @@
 
 Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio Version 17
-VisualStudioVersion = 17.12.35506.116
+# Visual Studio Version 18
+VisualStudioVersion = 18.4.11620.152 stable
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Linn.Common.Service", "src\Linn.Common.Service.csproj", "{C58B1BE7-9DAD-4F3A-AF6E-B9515DE0612B}"
 EndProject
@@ -35,4 +35,7 @@ Global
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
 	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {B39241F2-FBE3-462C-8F75-F37B6990D3C2}
+	EndGlobalSection
 EndGlobal

src/Handlers/StreamCopyingResultHandler.cs

@@ -40,9 +40,12 @@ public async Task Handle(
 
                     if (!string.IsNullOrEmpty(success.Data.FileName))
                     {
+                        var disposition = string.IsNullOrEmpty(success.Data.Disposition)
+                            ? "inline"
+                            : success.Data.Disposition;
                         res.Headers["Content-Disposition"] =
-                            $"inline; filename=\"{success.Data.FileName}\"";
-                    }
+                            $"{disposition}; filename=\"{success.Data.FileName}\"";
+                    }   
 
                     res.StatusCode = (int)HttpStatusCode.OK;
 
@@ -73,6 +76,14 @@ public async Task Handle(
                     }
                     break;
 
+                case ForbiddenResult<StreamResponse> forbidden:
+                    res.StatusCode = 403;
+                    if (!string.IsNullOrEmpty(forbidden.Message))
+                    {
+                        await res.WriteAsync(forbidden.Message, cancellationToken);
+                    }
+                    break;
+
                 case NotFoundResult<StreamResponse> _:
                     res.StatusCode = 404;
                     break;

src/Handlers/StreamResponse.cs

@@ -2,10 +2,13 @@
 {
     public class StreamResponse
     {
         public Stream Stream { get; set; }
 
         public string ContentType { get; set; }
 
         public string FileName { get; set; }
+
+        // inline (preview, e.g. PDFs) or attachment (force download, e.g. zips)
+        public string Disposition { get; set; } = "inline";
     }
 }

src/Linn.Common.Service.csproj

@@ -5,7 +5,7 @@
 		<ImplicitUsings>enable</ImplicitUsings>
 		<AssemblyName>Linn.Common.Service</AssemblyName>
 		<PackageId>Linn.Common.Service</PackageId>
-		<Version>3.1.0</Version>
+		<Version>3.2.0</Version>
 	  <Nullable>enable</Nullable>
 	</PropertyGroup>
 	<ItemGroup>

tests/WhenCopyingStreamResult.cs

@@ -0,0 +1,98 @@
+namespace Linn.Common.Service.Tests
+{
+    using System.IO;
+    using System.Net;
+    using System.Text;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    using FluentAssertions;
+
+    using Linn.Common.Facade;
+    using Linn.Common.Service.Handlers;
+
+    using Microsoft.AspNetCore.Http;
+
+    using NUnit.Framework;
+
+    public class WhenCopyingStreamResult
+    {
+        private StreamCopyingResultHandler handler;
+
+        private DefaultHttpContext context;
+
+        [SetUp]
+        public void SetUp()
+        {
+            this.handler = new StreamCopyingResultHandler();
+            this.context = new DefaultHttpContext();
+            this.context.Response.Body = new MemoryStream();
+        }
+
+        [Test]
+        public async Task ShouldCopySuccessStreamAndSetAttachmentDisposition()
+        {
+            var payload = Encoding.UTF8.GetBytes("zip-bytes");
+            var result = new SuccessResult<StreamResponse>(
+                new StreamResponse
+                {
+                    Stream = new MemoryStream(payload),
+                    ContentType = "application/zip",
+                    FileName = "linn-resources.zip",
+                    Disposition = "attachment"
+                });
+
+            await this.handler.Handle(this.context.Request, this.context.Response, result, CancellationToken.None);
+
+            this.context.Response.StatusCode.Should().Be((int)HttpStatusCode.OK);
+            this.context.Response.ContentType.Should().Be("application/zip");
+            this.context.Response.Headers["Content-Disposition"].ToString()
+                .Should().Be("attachment; filename=\"linn-resources.zip\"");
+
+            this.context.Response.Body.Position = 0;
+            using var reader = new StreamReader(this.context.Response.Body);
+            (await reader.ReadToEndAsync()).Should().Be("zip-bytes");
+        }
+
+        [Test]
+        public async Task ShouldDefaultToInlineDisposition()
+        {
+            var result = new SuccessResult<StreamResponse>(
+                new StreamResponse
+                {
+                    Stream = new MemoryStream(Encoding.UTF8.GetBytes("pdf")),
+                    ContentType = "application/pdf",
+                    FileName = "invoice.pdf"
+                });
+
+            await this.handler.Handle(this.context.Request, this.context.Response, result, CancellationToken.None);
+
+            this.context.Response.Headers["Content-Disposition"].ToString()
+                .Should().Be("inline; filename=\"invoice.pdf\"");
+        }
+
+        [Test]
+        public async Task ShouldReturn403ForForbiddenResult()
+        {
+            var result = new ForbiddenResult<StreamResponse>("Access denied");
+
+            await this.handler.Handle(this.context.Request, this.context.Response, result, CancellationToken.None);
+
+            this.context.Response.StatusCode.Should().Be((int)HttpStatusCode.Forbidden);
+
+            this.context.Response.Body.Position = 0;
+            using var reader = new StreamReader(this.context.Response.Body);
+            (await reader.ReadToEndAsync()).Should().Be("Access denied");
+        }
+
+        [Test]
+        public async Task ShouldReturn404ForNotFoundResult()
+        {
+            var result = new NotFoundResult<StreamResponse>("nope");
+
+            await this.handler.Handle(this.context.Request, this.context.Response, result, CancellationToken.None);
+
+            this.context.Response.StatusCode.Should().Be((int)HttpStatusCode.NotFound);
+        }
+    }
+}