From aa498fdfdf8e98118431b87fa12a337f3823329b Mon Sep 17 00:00:00 2001
From: justin <justin@liquidator.optimal-reality.com>
Date: Tue, 16 Jun 2026 00:23:40 -0500
Subject: [PATCH] admin docs: probe existence with ranged GET (HEAD fails
 presigned-URL sig)

---
 api/src/routes/admin.ts | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/api/src/routes/admin.ts b/api/src/routes/admin.ts
index 028cab8..6bc3166 100644
--- a/api/src/routes/admin.ts
+++ b/api/src/routes/admin.ts
@@ -676,8 +676,11 @@ router.get("/api/v1/admin/compliance-orders/:order_number/documents", requireAdm
       try {
         const url = await presignInternal(d.key);
         if (url) {
-          const head = await fetch(url, { method: "HEAD" });
-          present = head.ok;
+          // The presigned URL is signed for GET, so a HEAD request fails the
+          // signature check. Use a 1-byte ranged GET to confirm existence
+          // cheaply without downloading the whole object.
+          const probe = await fetch(url, { headers: { Range: "bytes=0-0" } });
+          present = probe.ok; // 200 or 206
         }
       } catch { /* treat as missing */ }
       return { ...d, exists: present };