Closes #2441

Summary

Fixed two bugs in scripts/vortex/download-db-acquia.sh that caused Acquia DB downloads to fail.

The Acquia API actions/download endpoint returns a 302 redirect to a presigned S3 URL. The previous implementation followed the redirect with -L, which could send the Authorization: Bearer header to S3 - S3 presigned URLs reject requests that carry extra auth headers, causing the download to return an error body instead of the archive. The fix captures only the redirect URL (without following it) and then makes a separate, auth-free curl call to S3.

Additionally, error branches that deleted partially-downloaded or corrupt files with rm -f were changed to leave those files in place so they can be inspected when something goes wrong.

Changes

scripts/vortex/download-db-acquia.sh

• Auth header leak fix: replaced curl --progress-bar -L ... | extract_json_value "url" with curl -s -o /dev/null -w "%{redirect_url}" ... to capture the S3 redirect URL without following it and without forwarding the Authorization header. The JSON-parsing branch was removed because the API only ever responds with a redirect, not a JSON body.
• Preserve files on failure: removed three rm -f calls from error branches (empty/missing download, invalid gzip, decompression failure) so the corrupt file is kept for inspection.
• Move cleanup to success path: moved rm "${file_name_compressed}" to after the decompression validity check so the compressed file is only deleted on a fully successful run.

.vortex/tests/bats/unit/download-db-acquia.bats

• Updated three test-case curl mocks for the "Discovering backup URL" step to match the new curl -s -o /dev/null -w %{redirect_url} signature and to return a plain URL string instead of a JSON body.

Before / After

OLD flow

Acquia API call
  curl --progress-bar -L
       -H "Authorization: Bearer <token>"
       https://…/actions/download
    │
    │  302 redirect (followed by -L)
    ▼
  S3 presigned URL  ← Authorization header forwarded here
    │
    │  S3 rejects extra auth → returns error XML body
    ▼
  Corrupt/empty file saved locally
    │
    │  gzip check or size check fails
    ▼
  rm -f  ← evidence deleted, nothing to inspect

NEW flow

Acquia API call (capture redirect only)
  curl -s -o /dev/null -w "%{redirect_url}"
       -H "Authorization: Bearer <token>"
       https://…/actions/download
    │
    │  302 redirect URL extracted, connection closed
    ▼
  backup_url = "https://s3.amazonaws.com/…?X-Amz-Signature=…"

S3 download (no auth header)
  curl --progress-bar -L "${backup_url}"
    │
    │  S3 accepts presigned URL, streams archive
    ▼
  Valid .sql.gz file saved locally
    │
    ├─ success → gunzip → rm compressed file
    │
    └─ failure → files left in place for inspection

Summary by CodeRabbit

• Bug Fixes

  • Enhanced error diagnostics for Acquia database backup operations by preserving intermediate files for inspection when download or decompression fails, enabling improved troubleshooting
  • Optimized backup URL discovery mechanism

• Tests

  • Updated test cases for Acquia backup URL discovery functionality