fix(file-service, frontend): reject slash in version names

[kunwp1]

What changes were proposed in this PR?

Root cause. createDatasetVersion names a version v{N} - {description} from whatever the user typed, and the UI accepted a /. The version name is one segment of the logical path /<prefix>/owner/resource/version/file, and FileResolver.parsePrefixedPath splits that path on /. For the path in the issue, /texera/bughunt-version-name/v3 - //file_name.png, the version becomes v3 - and /file_name.png becomes the file path, so the version lookup misses and presign-download returns a 500. createModelVersion builds its name the same way, so model versions have the same problem.

Fix. ResourceNaming.validateVersionDescription rejects a description containing / with a 400. createDatasetVersion and createModelVersion call it right after the write-access check, before the LakeFS commit, so the staged files stay staged and the user can fix the description and retry. The version uploader, which datasets and models both use, shows the error under the input and disables Submit, and Enter no longer submits either.

Before:  description "/"  ->  version "v3 - /"  ->  every file in it fails with presign-download 500
After:   description "/"  ->  400 "Invalid version description"  (UI: inline error, Submit disabled)

Not included. Versions already stored with a / in their name stay unopenable, and repairing them needs a data migration. A % or + in a name has a separate problem, because resolveVersionedFile URL-decodes filePath a second time.

Any related issues, documentation, discussions?

Closes #8882

How was this PR tested?

Tests were added for the validator, for both resources, and for the version uploader, and they were written first and failed against the old code.

sbt "FileService/testOnly org.apache.texera.service.resource.ResourceNamingSpec org.apache.texera.service.resource.DatasetResourceSpec org.apache.texera.service.resource.ModelUploadResourceSpec"
cd frontend && yarn ng test --watch=false --include='**/version-uploader.component.spec.ts'

The first command passes 177 tests and the second passes 73. scalafixAll, scalafmtAll, prettier-eslint and eslint ran clean on the changed files.

Screen.Recording.2026-10-06.at.11.49.20.AM.mov

Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code, Claude Sonnet 5.5

[github-actions]

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

• Contributors with relevant context: @tanishqgandhi1908
  You can notify them by mentioning @tanishqgandhi1908 in a comment.

[github-actions]

Backport auto-label report

This fix: PR was checked against each actively-supported release branch. A release/* label nominates a backport target; the branch's release manager approving this PR is what sends the fix there. The required Backport Approvals check stays red until every label below is approved, so each manager either approves or removes their own label — which is why the labels left on a merged PR are exactly the branches it reached.

Release branch	Analysis
✅ release/v1.3	Already labeled — this fix is queued to backport here. @mengw15 decides: approving sends the fix here, removing this label declines it. The merge waits on one or the other.
✅ release/v1.2	Already labeled — this fix is queued to backport here. @xuang7 decides: approving sends the fix here, removing this label declines it. The merge waits on one or the other.

Auto-label run.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.59%. Comparing base (ea0fc10) to head (5e967fb).

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #8883   +/-   ##
=========================================
  Coverage     92.59%   92.59%           
  Complexity     5059     5059           
=========================================
  Files          1255     1255           
  Lines         53622    53630    +8     
  Branches       6693     6694    +1     
=========================================
+ Hits          49652    49660    +8     
  Misses         2314     2314           
  Partials       1656     1656           

Flag	Coverage Δ		*Carryforward flag
access-control-service	77.38% <ø> (ø)
agent-service	99.16% <ø> (ø)		Carriedforward from ea0fc10
amber	88.09% <ø> (ø)		Carriedforward from ea0fc10
computing-unit-managing-service	60.48% <ø> (ø)
config-service	87.37% <ø> (ø)
file-service	82.00% <100.00%> (+0.05%)	⬆️
frontend	96.57% <100.00%> (+<0.01%)	⬆️
notebook-migration-service	83.73% <ø> (ø)
pyamber	98.58% <ø> (ø)		Carriedforward from ea0fc10
workflow-compiling-service	74.09% <ø> (ø)

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

🟡 Changes recommended

The new validation error is inaccessible to screen-reader users, and required manual UI verification details are missing.

2 open findings

• Associate validation errors with inputs and announce them accessibly · New
• Document manual Submit/Enter flow verification details · New

What changed in this PR

Prevents invalid dataset and model version descriptions containing /, avoiding unresolvable file paths.

Changes:

• Adds shared backend validation before LakeFS commits.
• Adds inline frontend validation and submission guards.
• Adds backend and frontend regression tests.

File	Description
version-uploader.component.ts	Blocks invalid submissions.
version-uploader.component.html	Displays validation and disables Submit.
version-uploader.component.scss	Styles the validation message.
version-uploader.component.spec.ts	Tests slash validation and Enter handling.
ResourceNaming.scala	Adds shared description validation.
DatasetResource.scala	Validates dataset versions before commit.
ModelResource.scala	Validates model versions before commit.
ResourceNamingSpec.scala	Tests validator boundaries.
DatasetResourceSpec.scala	Tests dataset rejection and retry.
ModelUploadResourceSpec.scala	Tests model rejection and retry.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mengw15]

LGTM