From 9594c4c99fdf1842e7193f5e83c98011a239dddb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A1n=20Jes=C3=BAs=20Pe=C3=B1a=20Rodr=C3=ADguez?=
 <adrianjpr@gmail.com>
Date: Thu, 13 Mar 2025 13:47:00 +0100
Subject: [PATCH] fix: add a handled response in case local files are missing
 (#7183)

---
 api/CHANGELOG.md                        |  1 +
 api/src/backend/api/tests/test_views.py | 19 +++++++++++++++++++
 api/src/backend/api/v1/views.py         | 10 +++++++++-
 3 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 47b25c5e33..183f82d495 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -15,6 +15,7 @@ All notable changes to the **Prowler API** are documented in this file.
 ## [v1.5.1] (Prowler v5.4.1)
 
 ### Fixed
+- Added a handled response in case local files are missing [(#7183)](https://github.com/prowler-cloud/prowler/pull/7183).
 - Fixed a race condition when deleting export files after the S3 upload [(#7172)](https://github.com/prowler-cloud/prowler/pull/7172).
 
 ---
diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py
index 597561b310..013a22bd12 100644
--- a/api/src/backend/api/tests/test_views.py
+++ b/api/src/backend/api/tests/test_views.py
@@ -2288,6 +2288,25 @@ class TestScanViewSet:
         assert f'filename="{expected_filename}"' in content_disposition
         assert response.content == b"s3 zip content"
 
+    def test_report_s3_success_no_local_files(
+        self, authenticated_client, scans_fixture, monkeypatch
+    ):
+        """
+        When output_location is a local path and glob.glob returns an empty list,
+        the view should return HTTP 404 with detail "The scan has no reports."
+        """
+        scan = scans_fixture[0]
+        scan.output_location = "/tmp/nonexistent_report_pattern.zip"
+        scan.state = StateChoices.COMPLETED
+        scan.save()
+        monkeypatch.setattr("api.v1.views.glob.glob", lambda pattern: [])
+
+        url = reverse("scan-report", kwargs={"pk": scan.id})
+        response = authenticated_client.get(url)
+
+        assert response.status_code == 404
+        assert response.json()["errors"]["detail"] == "The scan has no reports."
+
     def test_report_local_file(
         self, authenticated_client, scans_fixture, tmp_path, monkeypatch
     ):
diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py
index 993b3dfbed..7801e93110 100644
--- a/api/src/backend/api/v1/views.py
+++ b/api/src/backend/api/v1/views.py
@@ -1,6 +1,7 @@
 import glob
 import os
 
+import sentry_sdk
 from allauth.socialaccount.providers.github.views import GitHubOAuth2Adapter
 from allauth.socialaccount.providers.google.views import GoogleOAuth2Adapter
 from botocore.exceptions import ClientError, NoCredentialsError, ParamValidationError
@@ -1290,7 +1291,14 @@ class ScanViewSet(BaseRLSViewSet):
             filename = os.path.basename(output_location.split("/")[-1])
         else:
             zip_files = glob.glob(output_location)
-            file_path = zip_files[0]
+            try:
+                file_path = zip_files[0]
+            except IndexError as e:
+                sentry_sdk.capture_exception(e)
+                return Response(
+                    {"detail": "The scan has no reports."},
+                    status=status.HTTP_404_NOT_FOUND,
+                )
             with open(file_path, "rb") as f:
                 file_content = f.read()
             filename = os.path.basename(file_path)