fix: optional chaining on S3 metadata, string-safe streamToBuffer, epoch fallback for lastModified

- HIGH-01: add ?. to err["$metadata"] access in S3FileStore.exists()
- LOW-01: guard streamToBuffer data chunks against string-mode streams
- LOW-02: use new Date(0) instead of new Date() when Azure/GCP lastModified is absent

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: saby1101

ISSUES.md

@@ -5,15 +5,17 @@
 | #   | Date       | Description                                                                                                     | New Issues           | False Positives |
 | --- | ---------- | --------------------------------------------------------------------------------------------------------------- | -------------------- | --------------- |
 | 1   | 2026-05-09 | Initial audit — file-store, utils, types, all specs (cloud providers + utils only; LocalFileStore out of scope) | 1 HIGH, 2 MED, 2 LOW | 0               |
-| 2   | 2026-05-10 | Re-verify MED-02 after researching credentialDefaultProvider in S3Client source                                 | 0                    | 1 (MED-02)      |
+| 2   | 2026-05-10 | Re-verify MED-02 after researching credentialDefaultProvider in S3Client source; fix HIGH-01, LOW-01, LOW-02    | 0                    | 1 (MED-02)      |
 
 ---
 
 ## Fixed Issues
 
-| ID  | Issue | Commit |
-| --- | ----- | ------ |
-| —   | —     | —      |
+| ID      | Issue                                                                     | Commit  |
+| ------- | ------------------------------------------------------------------------- | ------- |
+| HIGH-01 | Unsafe `err["$metadata"].httpStatusCode` access in `S3FileStore.exists()` | pending |
+| LOW-01  | `streamToBuffer` unsafe with string-mode streams                          | pending |
+| LOW-02  | Azure/GCP `getInfo()` fallback to `new Date()` for missing `lastModified` | pending |
 
 ## False Positives Removed
 
@@ -25,40 +27,11 @@
 
 ## Table of Contents
 
-- [HIGH Issues (1 remaining)](#high-issues)
 - [MEDIUM Issues (1 remaining)](#medium-issues)
-- [LOW Issues (2 remaining)](#low-issues)
 - [Summary](#summary)
 
 ---
 
-## HIGH Issues
-
-### HIGH-01: Unsafe `err["$metadata"].httpStatusCode` access in `S3FileStore.exists()`
-
-**File:** `src/file-store.ts:327`
-**Severity:** HIGH — if the thrown error has no `$metadata` property (network error, credentials error, SDK version change), this line throws `TypeError: Cannot read properties of undefined`, masking the original error entirely.
-
-```typescript
-if (err["$metadata"].httpStatusCode === 404) {   // no optional chaining
-```
-
-The same class's `getInfo()` method at line 425 uses optional chaining correctly:
-
-```typescript
-err["$metadata"]?.httpStatusCode === 404;
-```
-
-**Suggested fix:** Apply optional chaining to match `getInfo()`:
-
-```typescript
-if (err["$metadata"]?.httpStatusCode === 404) {
-  return false;
-}
-```
-
----
-
 ## MEDIUM Issues
 
 ### MED-01: No TypeScript augmentation for `FastifyInstance.FileStore`
@@ -90,60 +63,11 @@ Also remove `diagnostics: false` from `jest.config.js` so TypeScript errors surf
 
 ---
 
-## LOW Issues
-
-### LOW-01: `streamToBuffer` is unsafe when a stream emits string chunks
-
-**File:** `src/utils.ts:6-14`
-**Severity:** LOW — if `setEncoding()` was called on the stream before passing it to `streamToBuffer`, Node.js emits `string` chunks instead of `Buffer`s. Pushing strings into the `Buffer[]` array causes `Buffer.concat()` to throw a `TypeError` at runtime.
-
-```typescript
-const chunks: Buffer[] = [];
-stream.on("data", (chunk) => chunks.push(chunk)); // chunk may be a string
-// ...
-Buffer.concat(chunks); // throws TypeError if any chunk is a string
-```
-
-The `DataStream` interface's `on("data")` listener signature is `(...args: any[])`, so TypeScript does not catch this.
-
-**Suggested fix:**
-
-```typescript
-stream.on("data", (chunk: Buffer | string) =>
-  chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)),
-);
-```
-
----
-
-### LOW-02: `AzureFileStore.getInfo()` falls back to `new Date()` for missing `lastModified`
-
-**File:** `src/file-store.ts:217`
-**Severity:** LOW — when Azure returns properties without a `lastModified` timestamp, the code silently substitutes the current time, making the returned `FileInfo` appear freshly modified. Callers using `lastModified` for cache invalidation or change detection will receive incorrect data.
-
-```typescript
-lastModified: properties.lastModified || new Date(),
-```
-
-The same pattern exists in `GCPFileStore.getInfo()` at line 300.
-
-**Suggested fix:** Throw or surface the absence explicitly rather than substituting the current time:
-
-```typescript
-lastModified: properties.lastModified ?? (() => { throw new Error("lastModified missing from Azure response"); })(),
-```
-
-Or, if a sentinel is acceptable, document it clearly and use a fixed epoch (`new Date(0)`) so callers can detect the fallback.
-
----
-
 ## Summary
 
 | Severity                    | Remaining  |
 | --------------------------- | ---------- |
-| **HIGH**                    | 1          |
 | **MEDIUM**                  | 1          |
-| **LOW**                     | 2          |
-| **TOTAL**                   | **4 open** |
-| **Fixed**                   | 0          |
-| **False Positives Removed** | 0          |
+| **TOTAL**                   | **1 open** |
+| **Fixed**                   | 3          |
+| **False Positives Removed** | 1          |

src/file-store.ts

@@ -214,7 +214,7 @@ class AzureFileStore implements FileStore {
       return {
         size: properties.contentLength || 0,
         contentType: properties.contentType || "application/octet-stream",
-        lastModified: properties.lastModified || new Date(),
+        lastModified: properties.lastModified || new Date(0),
       };
     } catch (err) {
       if (err.statusCode === 404) {
@@ -297,7 +297,7 @@ class GCPFileStore implements FileStore {
         contentType: metadata.contentType || "application/octet-stream",
         lastModified: metadata.updated
           ? new Date(metadata.updated)
-          : new Date(),
+          : new Date(0),
       };
     } catch (err) {
       if (err.code === 404) {
@@ -324,7 +324,7 @@ class S3FileStore implements FileStore {
       if (err instanceof S3.NoSuchKey) {
         return false;
       }
-      if (err["$metadata"].httpStatusCode === 404) {
+      if (err["$metadata"]?.httpStatusCode === 404) {
         return false;
       }
       throw err;

src/utils.ts

@@ -5,7 +5,9 @@ export interface DataStream {
 export function streamToBuffer(stream: DataStream): Promise<Buffer> {
   return new Promise<Buffer>((resolve, reject) => {
     const chunks: Buffer[] = [];
-    stream.on("data", (chunk) => chunks.push(chunk));
+    stream.on("data", (chunk: Buffer | string) =>
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)),
+    );
     stream.on("error", (err) => reject(err));
     stream.on("end", () =>
       resolve(chunks.length === 1 ? chunks[0] : Buffer.concat(chunks)),