com.sap.cds
cds-adapter-odata-v4
diff --git a/samples/bookshop/srv/src/main/java/customer/bookshop/handlers/MalwareScanRestHandler.java b/samples/bookshop/srv/src/main/java/customer/bookshop/handlers/MalwareScanRestHandler.java
new file mode 100644
index 000000000..bdcda325d
--- /dev/null
+++ b/samples/bookshop/srv/src/main/java/customer/bookshop/handlers/MalwareScanRestHandler.java
@@ -0,0 +1,98 @@
+package customer.bookshop.handlers;
+
+import com.sap.cds.feature.attachments.service.MalwareScannerService;
+import com.sap.cds.feature.attachments.service.malware.client.MalwareScanResultStatus;
+import jakarta.servlet.http.HttpServletRequest;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.HashMap;
+import java.util.Map;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.multipart.MultipartFile;
+
+/**
+ * REST Controller demonstrating the standalone {@link MalwareScannerService} introduced in
+ * cds-feature-attachments 1.6.0.
+ *
+ * The malware scanner is decoupled from attachment storage: any content can be scanned by
+ * injecting {@link MalwareScannerService} from the CAP service catalog and calling {@code
+ * scanContent(InputStream)}. No attachment entity, composition, or CDS model changes are required.
+ *
+ *
+ * - {@code POST /api/v1/malware/scan} — raw request body
+ *
- {@code POST /api/v1/malware/scan/upload} — multipart/form-data with {@code file} field
+ *
+ *
+ * Response body: {@code {"status": "CLEAN" | "INFECTED" | "ENCRYPTED" | "NO_SCANNER" | "FAILED"}}.
+ *
+ * When no {@code malware-scanner} service binding is available the response is {@code
+ * NO_SCANNER}. To get real scan results, bind the SAP Malware Scanning Service via {@code cds bind
+ * malware-scanner -2 :} and restart in hybrid mode.
+ */
+@RestController
+@RequestMapping("/api/v1/malware")
+public class MalwareScanRestHandler {
+
+ private static final Logger logger = LoggerFactory.getLogger(MalwareScanRestHandler.class);
+
+ @Autowired
+ private MalwareScannerService malwareScannerService;
+
+ /**
+ * Scans a raw request body for malware.
+ *
+ * Example: {@code curl -u admin:admin -X POST --data-binary @somefile.pdf
+ * http://localhost:8080/api/v1/malware/scan}
+ */
+ @PostMapping("/scan")
+ public ResponseEntity> scan(HttpServletRequest request) {
+ try (InputStream body = request.getInputStream()) {
+ MalwareScanResultStatus status = malwareScannerService.scanContent(body);
+ Map response = new HashMap<>();
+ response.put("status", status.name());
+ return ResponseEntity.ok(response);
+ } catch (IOException e) {
+ logger.error("Failed to read request body for malware scan.", e);
+ return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+ .body(Map.of("error", "Failed to read request body: " + e.getMessage()));
+ } catch (Exception e) {
+ logger.error("Malware scan failed.", e);
+ return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+ .body(Map.of("error", "Malware scan failed: " + e.getMessage()));
+ }
+ }
+
+ /**
+ * Scans an uploaded file (multipart/form-data) for malware.
+ *
+ * Example: {@code curl -u admin:admin -F file=@eicar.txt
+ * http://localhost:8080/api/v1/malware/scan/upload}
+ */
+ @PostMapping("/scan/upload")
+ public ResponseEntity> scanUpload(@RequestParam("file") MultipartFile file) {
+ try (InputStream content = file.getInputStream()) {
+ MalwareScanResultStatus status = malwareScannerService.scanContent(content);
+ Map response = new HashMap<>();
+ response.put("status", status.name());
+ response.put("filename", file.getOriginalFilename());
+ response.put("size", file.getSize());
+ return ResponseEntity.ok(response);
+ } catch (IOException e) {
+ logger.error("Failed to read uploaded file for malware scan.", e);
+ return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+ .body(Map.of("error", "Failed to read uploaded file: " + e.getMessage()));
+ } catch (Exception e) {
+ logger.error("Malware scan failed.", e);
+ return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+ .body(Map.of("error", "Malware scan failed: " + e.getMessage()));
+ }
+ }
+}
diff --git a/samples/bookshop/srv/src/test/java/customer/bookshop/ApplicationTest.java b/samples/bookshop/srv/src/test/java/customer/bookshop/ApplicationTest.java
index 152543a5b..92b23c7cc 100644
--- a/samples/bookshop/srv/src/test/java/customer/bookshop/ApplicationTest.java
+++ b/samples/bookshop/srv/src/test/java/customer/bookshop/ApplicationTest.java
@@ -4,7 +4,7 @@
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
+import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.context.ApplicationContext;