Add an option to download flagged files for business users

[ArcticLampyrid]

Partial close #3821

Sadly Prefer: forceInfectedDownload has no effect on personal accounts. Only enterprise environment can use...

[abraunegg]

@ArcticLampyrid

Please can you resolve the conflicts for this PR

[abraunegg]

Thanks for working on this feature.

The overall approach is sound: the existing behaviour remains opt-in, malware detection is based on the malware facet, and only flagged files are redirected to the Microsoft Graph beta contentStream endpoint with Prefer: forceInfectedDownload.

There are, however, a few changes I would like made before this can be merged.

1. Preserve the existing normal download behaviour

The current master download path uses:

/content?AVOverride=1

This has existed in the client for many years and was originally introduced specifically to deal with antivirus-related download behaviour.

This PR currently changes the ordinary download URL to:

/content

That is outside the scope of this feature request and changes behaviour for every normal file download.

Please preserve the existing URL for normal downloads:

const(char)[] url = driveByIdUrl ~ driveId ~ "/items/" ~ itemId ~ "/content?AVOverride=1";

and only replace it with the beta endpoint when all of the following are true:

• the DriveItem contains the malware facet
• download_flagged_files = "true"
• the account type supports this functionality

The desired behaviour should therefore remain:

Normal file
  -> existing /content?AVOverride=1 path

Malware flagged file + download_flagged_files=false
  -> refuse download

Malware flagged file + download_flagged_files=true
  -> beta contentStream + Prefer: forceInfectedDownload

There should be no behavioural change for existing users who do not enable this new option.

2. Handle Personal accounts explicitly

The PR documentation correctly states that this mechanism is not applicable to OneDrive Personal accounts.

The implementation should reflect that rather than attempting a beta contentStream request which is expected to fail.

Please add an explicit account-type check so that when:

accountType == "personal"

and a malware-flagged download is requested with download_flagged_files = "true", the client produces a clear message explaining that malware override downloads are not supported for OneDrive Personal accounts.

3. Validate this using the authentication model supported by this client

The rclone implementation referenced by the issue demonstrated successful malware downloads primarily using application permissions / client_credentials.

This client currently uses delegated user OAuth authentication.

Before this is merged, please provide real-world validation using this PR against an actual OneDrive Business tenant using the authentication flow supported by this client.

At minimum I would like validation of:

• download_flagged_files = "false" continues to refuse a malware-flagged file
• download_flagged_files = "true" successfully downloads a malware-flagged file where Microsoft tenant policy permits it
• a policy/permission-denied malware download fails cleanly without promoting a .partial file or incorrectly updating local database state
• a normal non-malware file continues to download successfully using the existing stable download path
• ideally, a malware-flagged file through the Business Shared Files path as this PR specifically modifies malware-facet propagation there

Please include debug evidence showing the relevant Graph request and resulting behaviour.

4. Strengthen the documentation around the beta API

Please make it explicit in the configuration documentation that this functionality depends on a Microsoft Graph beta endpoint.

Microsoft states that beta APIs are subject to change and are not supported for production use in the same way as the stable v1.0 API.

This is acceptable here because the feature is explicitly opt-in, but users enabling it should understand that limitation.

5. Testing

The metadata propagation changes for Business Shared Files look appropriate, particularly because Graph Search responses may omit facets which are present on the authoritative DriveItem.

However, this feature currently has no focused regression coverage.

Please add applicable focused test coverage where practical, particularly around the decision logic:

malware=false
    -> normal download path

malware=true + option=false
    -> download rejected

malware=true + option=true
    -> malware override download path

The objective here is to ensure this feature remains completely isolated from the normal download path.

---

I do not think the overall implementation needs redesigning.

The main requirement is to keep this change tightly scoped: preserve the existing normal download behaviour, explicitly handle unsupported Personal accounts, and provide evidence that forceInfectedDownload actually works using this client's delegated Business authentication model before merge.