POST /api/workflow accepts externalInputPayloadStoragePath without validating storage is configured; should return 400 instead of 500

[nickorkes]

Summary

• POST /api/workflow accepts the externalInputPayloadStoragePath field unconditionally
• No validation that external payload storage is actually configured.
• On a server with no storage backend, start workflow fails with an internal-error 500 where an upfront 400 with a clear message is more appropriate

Environment

• conductor-oss/conductor v3.32.1, standalone container (conductoross/conductor:3.32.1)
• No external payload storage configured
  • conductor.external-payload-storage.type is unset

Steps to reproduce

Register any minimal workflow:

curl -X PUT http://localhost:8080/api/metadata/workflow \
  -H 'Content-Type: application/json' \
  -d '[{"name":"payload_path_repro","version":1,"schemaVersion":2,
       "ownerEmail":"you@example.com","timeoutSeconds":0,
       "tasks":[{"name":"echo","taskReferenceName":"echo_ref","type":"JSON_JQ_TRANSFORM",
                 "inputParameters":{"in":"${workflow.input}","queryExpression":"{got: .in}"}}]}]'

Start it with the storage-path field

curl -X POST http://localhost:8080/api/workflow \
  -H 'Content-Type: application/json' \
  -d '{"name":"payload_path_repro","version":1,
       "externalInputPayloadStoragePath":"workflow/input/nonexistent.json"}'

Actual output

{"status":500,"message":"Unable to download payload from external storage path: workflow/input/nonexistent.json","instance":"f6c8fce328b5","retryable":false}
HTTP 500

Expected

A 400 rejection at the request instead of a server-side erro, something like external payload storage is not configured on this server.

Root cause

• The field never checks that a real backend exists
• The default backend is DummyPayloadStorage, whose download() returns null.
• The null blows up inside ExternalPayloadStorageUtils.downloadPayload and is wrapped as NonTransientException → 500.

Proposed fix

Validate at the API boundary (or at least in startWorkflow)

[abhiramaab]

Hi! I'd love to work on this issue. I can add validation at the API boundary to check if ExternalPayloadStorage is actually configured (and not just falling back to DummyPayloadStorage) before accepting the externalInputPayloadStoragePath. I'll ensure it throws a clear 400 Bad Request exception. Please let me know if I can go ahead and submit a PR!