[cdbartholomew]

Problem

Exporting a bank whose id contains a space, a dot, or non-ASCII characters (e.g. Express AI — Trial) completes, but downloading the archive from the returned download_url fails on GCS:

<Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message>…

Why:

• Since storage keys started percent-encoding their segments (key_segment), such a bank's files are stored under an object name that literally contains %. For example, …/banks/Express%20AI%20%E2%80%94%20Trial/exports/<uuid>/transfer.zip is the actual object name.
• obstore's GCS signer puts the key into the URL path unescaped. GCS decodes the path, looks up Express AI — Trial/…, a different object, and returns 404.
• obstore's own get and head escape correctly, which is why storing and reading through the backend work and only the presigned URL is broken.

The same applies to any presigned download on GCS, not only exports.

Fix

GCSFileStorage.get_download_url escapes % as %25 before signing:

• The signed path decodes back to the literal object name.
• The signature is computed over that same path, so it still validates.
• Keys without % are signed exactly as before.

GCS only: obstore's S3 and Azure signers already escape %, so pre-escaping there would double-encode. Both are now pinned by the test below.

Testing

• New tests/test_file_storage_signed_urls.py: signs for real, offline — obstore's signers with throwaway credentials, so no network, bucket or container is needed — and asserts the URL path decodes back to the stored object name for plain-bank, Express AI — Trial, team.notes and 100% done.
  • It runs for all three obstore backends (GCS, S3, Azure): the sibling nobody tested is the one that breaks, and the SeaweedFS suite that covered S3 is skipped in CI.
  • With the fix: 16/16 pass. Without it, the 3 encoded GCS cases fail. S3 and Azure pass either way, confirming they need no escaping.
  • test_every_obstore_backend_is_covered enumerates the storage package, so a fourth backend cannot land without signing coverage.
• tests/test_file_storage_s3.py: the presigned-URL test previously only checked that the result was a URL string; it now downloads through the presigned URL against SeaweedFS for the same bank ids and asserts the bytes — the real-server proof behind the offline contract.
• Against a real GCS bucket, for a stored archive under an encoded bank id:
  • the URL from current main → 404 NoSuchKey;
  • with this change → 200, full archive, valid zip.
• Storage suites: test_bank_file_storage and test_file_storage_bytes_contract pass locally, plus ruff and ty check.