fix(blob): normalize contentDisposition in copy() when addRandomSuffix is enabled

.changeset/fix-blob-copy-content-disposition.md

@@ -0,0 +1,11 @@
+---
+'@vercel/blob': patch
+---
+
+fix(blob): normalize contentDisposition filename in copy() when addRandomSuffix is enabled
+
+When `copy()` is called with `addRandomSuffix: true`, the Vercel Blob API
+returns a `contentDisposition` header containing the suffixed filename
+(e.g. `attachment; filename="report-abc123.pdf"`). The SDK now normalizes
+this to always use the original `toPathname` filename, matching the
+behaviour already enforced for `put()`.

packages/blob/src/copy.ts

@@ -1,6 +1,7 @@
 import { MAXIMUM_PATHNAME_LENGTH, requestApi } from './api';
 import type { CommonCreateBlobOptions } from './helpers';
 import { BlobError, disallowedPathnameCharacters } from './helpers';
+import { normalizeContentDisposition } from './put-helpers';
 
 export type CopyCommandOptions = CommonCreateBlobOptions;
 
@@ -98,7 +99,11 @@ export async function copy(
     downloadUrl: response.downloadUrl,
     pathname: response.pathname,
     contentType: response.contentType,
-    contentDisposition: response.contentDisposition,
+    contentDisposition: normalizeContentDisposition(
+      response.contentDisposition,
+      toPathname,
+      response.pathname,
+    ),
     etag: response.etag,
   };
 }

packages/blob/src/index.node.test.ts

@@ -1192,6 +1192,53 @@ describe('blob client', () => {
       });
       expect(headers['x-vercel-blob-access']).toEqual('public');
     });
+
+    it('normalizes contentDisposition to use original toPathname when API adds random suffix', async () => {
+      const mockedCopyResult = {
+        url: `${BLOB_STORE_BASE_URL}/destination-abc123.txt`,
+        downloadUrl: `${BLOB_STORE_BASE_URL}/destination-abc123.txt?download=1`,
+        pathname: 'destination-abc123.txt',
+        contentType: 'text/plain',
+        contentDisposition: 'attachment; filename="destination-abc123.txt"',
+        etag: '"def456"',
+      };
+
+      mockClient
+        .intercept({ path: () => true, method: 'PUT' })
+        .reply(200, mockedCopyResult);
+
+      const result = await copy('source.txt', 'destination.txt', {
+        access: 'public',
+        addRandomSuffix: true,
+      });
+
+      expect(result.contentDisposition).toBe(
+        'attachment; filename="destination.txt"',
+      );
+    });
+
+    it('does not modify contentDisposition when copy pathname is unchanged', async () => {
+      const mockedCopyResult = {
+        url: `${BLOB_STORE_BASE_URL}/destination.txt`,
+        downloadUrl: `${BLOB_STORE_BASE_URL}/destination.txt?download=1`,
+        pathname: 'destination.txt',
+        contentType: 'text/plain',
+        contentDisposition: 'attachment; filename="destination.txt"',
+        etag: '"def456"',
+      };
+
+      mockClient
+        .intercept({ path: () => true, method: 'PUT' })
+        .reply(200, mockedCopyResult);
+
+      const result = await copy('source.txt', 'destination.txt', {
+        access: 'public',
+      });
+
+      expect(result.contentDisposition).toBe(
+        'attachment; filename="destination.txt"',
+      );
+    });
   });
 
   describe('get', () => {

packages/blob/src/put-helpers.ts

@@ -8,6 +8,33 @@ import type { ClientCommonCreateBlobOptions } from './client';
 import type { CommonCreateBlobOptions } from './helpers';
 import { BlobError, disallowedPathnameCharacters } from './helpers';
 
+/**
+ * Normalizes contentDisposition to use the original requested filename
+ * instead of the API-returned pathname (which may include a random suffix).
+ * This ensures `contentDisposition` always reflects the name the caller
+ * provided, regardless of `addRandomSuffix` being enabled.
+ */
+export function normalizeContentDisposition(
+  contentDisposition: string,
+  originalPathname: string,
+  responsePathname: string,
+): string {
+  const originalFilename =
+    originalPathname.split('/').pop() ?? originalPathname;
+  const responseFilename =
+    responsePathname.split('/').pop() ?? responsePathname;
+  if (
+    originalFilename !== responseFilename &&
+    contentDisposition.includes(`"${responseFilename}"`)
+  ) {
+    return contentDisposition.replace(
+      `"${responseFilename}"`,
+      `"${originalFilename}"`,
+    );
+  }
+  return contentDisposition;
+}
+
 export const putOptionHeaderMap = {
   cacheControlMaxAge: 'x-cache-control-max-age',
   addRandomSuffix: 'x-add-random-suffix',