From 871a1613274db0b5ff2f92da3002cbe93fc872e4 Mon Sep 17 00:00:00 2001
From: Sychic <47618543+Sychic@users.noreply.github.com>
Date: Fri, 21 Aug 2026 15:40:16 -0400
Subject: [PATCH] feat(app-lib): send file hash (#7266)

---
 .../app-lib/src/api/instance/shared/client.rs | 24 +++++++++++--------
 .../src/api/instance/shared/publish.rs        |  7 ++++++
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/packages/app-lib/src/api/instance/shared/client.rs b/packages/app-lib/src/api/instance/shared/client.rs
index 132034e982..52fdc788cf 100644
--- a/packages/app-lib/src/api/instance/shared/client.rs
+++ b/packages/app-lib/src/api/instance/shared/client.rs
@@ -823,7 +823,8 @@ pub(super) async fn send_bytes_request(
 ) -> crate::Result<reqwest::Response> {
     let base_url = service_base_url();
     let url = service_url(base_url, path);
-    send_bytes_request_to_url(operation, method, path, &url, body, state).await
+    send_bytes_request_to_url(operation, method, path, &url, body, None, state)
+        .await
 }
 
 pub(super) async fn send_bytes_request_to_url(
@@ -832,6 +833,7 @@ pub(super) async fn send_bytes_request_to_url(
     path: &str,
     url: &str,
     body: Vec<u8>,
+    file_sha512: Option<&str>,
     state: &State,
 ) -> crate::Result<reqwest::Response> {
     let service_origin = url::Url::parse(service_base_url())
@@ -872,18 +874,20 @@ pub(super) async fn send_bytes_request_to_url(
         "Sending shared instances API request"
     );
 
-    let response = shared_instances_client(url)
+    let mut request = shared_instances_client(url)
         .request(method.clone(), url)
         .bearer_auth(credentials.session)
         .header(reqwest::header::CONTENT_TYPE, "application/octet-stream")
-        .body(body)
-        .send()
-        .await
-        .map_err(|error| {
-            crate::ErrorKind::SharedInstancesApiError(
-                error.without_url().to_string(),
-            )
-        })?;
+        .body(body);
+    if let Some(file_sha512) = file_sha512 {
+        request = request.header("x-file-sha512", file_sha512);
+    }
+
+    let response = request.send().await.map_err(|error| {
+        crate::ErrorKind::SharedInstancesApiError(
+            error.without_url().to_string(),
+        )
+    })?;
 
     if response.status().is_success() {
         let request_id = response_request_id(&response);
diff --git a/packages/app-lib/src/api/instance/shared/publish.rs b/packages/app-lib/src/api/instance/shared/publish.rs
index c60ae4f806..74b737bd26 100644
--- a/packages/app-lib/src/api/instance/shared/publish.rs
+++ b/packages/app-lib/src/api/instance/shared/publish.rs
@@ -6,6 +6,7 @@ use super::*;
 use async_walkdir::WalkDir;
 use async_zip::{Compression, ZipEntryBuilder};
 use futures::StreamExt;
+use sha2::Digest;
 use std::collections::BTreeMap;
 
 #[tracing::instrument]
@@ -1018,12 +1019,18 @@ pub(super) async fn upload_external_files(
                 "Invalid shared instance external file upload URL: {error}"
             ))
         })?;
+        let (bytes, file_sha512) = tokio::task::spawn_blocking(move || {
+            let hash = format!("{:x}", sha2::Sha512::digest(&bytes));
+            (bytes, hash)
+        })
+        .await?;
         let response = send_bytes_request_to_url(
             "upload_external_file",
             Method::PUT,
             upload_url.path(),
             &upload.url,
             bytes,
+            Some(&file_sha512),
             state,
         )
         .await?;