Predisk ClamAV Scan 1755

[S-S-T]

Pre-Disk ClamAV Attachment Scanning Epic

Summary

Finalizes all back-end work for the pre-disk ClamAV attachment scanning epic, including Tickets #1751, #1752, #1753, and #1754 — all consolidated into this PR for #1755. This is the single source of truth for this epic.

• Px deployments: attachments are scanned pre-disk in the Busboy stream before any filesystem or MongoDB writes.
• Non-Px deployments: scans are safely skipped; attachments are passed directly to storeAttachmentContent().
• All acceptance criteria from Krista and Story 0 lifecycle are satisfied.
• There is NO front-end/UI messaging included in this PR (that will be delivered in the next ticket, #1756)

Key Features & Behavior

ClamAV Scan

• Pre-disk scanning occurs in the Busboy stream for Px deployments.
• Infected files (e.g., eicar.txt) are rejected with a clear error message.
• Clean files pass successfully.
• Non-Px deployments skip scanning safely.

Attachment Lifecycle

• Fully respects the Story 0 attachment lifecycle.
• Pre-disk scan occurs before filesystem writes and MongoDB commits.
• Handles partial attachments correctly: incomplete uploads trigger proper rejection/error reporting.

Front-End

• Page updates automatically; no manual refresh required.
• Users see only success or failure of the attachment; no ClamAV internal messages are exposed.

Pre-Testing / Local Setup

AWS SSO Login and ClamAV Forwarding

To run the pre-disk ClamAV scan process, ensure the following is in place:

1. Add the ClamAV environment variable to docker-compose.yml just under SFTP_PLUGIN_CONFIG_SALT (around line 38):

CLAM_AV_URL: tcp://clamav:3310

2. AWS SSO Login
   • You must have an AWS account for magegov.
   • Open a terminal and run:
     aws sso login --profile magegov

• Follow the web page flow, including two-factor authentication (Authy, DUO, etc.).

3. Forward to the PX ClamAV server:
   kubectl port-forward svc/clamav 3310:3310 -n clamav

• You should see output like:

Forwarding from 127.0.0.1:3310 -> 3310
Forwarding from [::1]:3310 -> 3310

• Leave this terminal window running while testing.

Testing

• Verify that EICAR.txt is rejected.
• Verify multiple clean files (PNG, text) are accepted.
• Confirm Px/non-Px behavior matches configuration.
• End-to-end attachment lifecycle can be verified.

Conclusion

This PR includes, consolidates and proves all back-end work for the pre-disk ClamAV attachment scanning epic.