John O'Keefe
f24a2d6c22
Closes the remaining integration-suite failures (handoff open bug 3),
line by line:
- Fixture family (the upsert equivalence): tags_filter_test
("Science Fiction" found 1 of 3; "Fantasy" 404'd on zero results),
media_item_isbn_test (normalization read back the first case's ISBN
everywhere; edge cases saw a nil ISBN; pagination collapsed 5
creates onto 1 row), search_unified_test (its 3 books were actually
1 row + two no-op creates) — all POSTed a constant file_path into
one library while CreateMediaItem upserts ON CONFLICT
(library_id, file_path). Every fixture now uses unique per-item
paths, the suite's universal convention elsewhere. TestTagsFilter
confirmed same-family: counts came right with no second bug.
- New TestMediaItemCreateDuplicatePath pins the honest-create
contract from da13898: 201 for the first create; 200 + duplicate
flag + the EXISTING row (never a 201 lie), second payload not
overwritten.
- library_browse_test: the admin subtest browsed the container's
/tmp and required it non-empty — env-coupled (empty /tmp → "was
[]"). Now browses a self-created t.TempDir with two subdirs and a
decoy file, asserting ONLY directories are listed.
- series_integration_test: three stale assertions re-anchored to the
shipped contracts, each with a ground-truth comment: /dashboard/
sections key identity on the collection NAME (BuildSections ID =
CollectionName; the web/app reorder + hidden prefs persist those
strings) — the kebab query_type is the storage key and is not
exposed; /api/series/books is name-ONLY (the app client and the
web SSR page both send name only; library_id is ignored, never
validated); /api/series is optional-scope BY DESIGN (GetDistinct-
Series: narg IS NULL OR library_id = narg aggregates across
libraries when omitted). The former 400-on-missing-library_id
expectations asserted validation that never shipped.
- gofmt rider on three untouched-in-this-arc test files
(dashboard_integration, search, test_helpers).
Full suite with -parallel=1: 217 groups pass, zero failures.
78 lines
2.6 KiB
Go
78 lines
2.6 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestBrowseLibraryFoldersEndpoint(t *testing.T) {
|
|
setup := setupTestServer(t)
|
|
|
|
t.Run("GET /api/libraries/browse - no authentication returns 401", func(t *testing.T) {
|
|
req := httptest.NewRequest("GET", "/api/libraries/browse?path=/tmp", nil)
|
|
rec := httptest.NewRecorder()
|
|
setup.Server.Config.Handler.ServeHTTP(rec, req)
|
|
assert.Equal(t, http.StatusUnauthorized, rec.Code)
|
|
})
|
|
|
|
t.Run("GET /api/libraries/browse - regular user returns 403 forbidden", func(t *testing.T) {
|
|
req := httptest.NewRequest("GET", "/api/libraries/browse?path=/tmp", nil)
|
|
req.Header.Set("Authorization", "Bearer "+setup.RegularToken)
|
|
rec := httptest.NewRecorder()
|
|
setup.Server.Config.Handler.ServeHTTP(rec, req)
|
|
assert.Equal(t, http.StatusForbidden, rec.Code)
|
|
})
|
|
|
|
t.Run("GET /api/libraries/browse - admin can browse directories", func(t *testing.T) {
|
|
// Self-created fixture dir: the container's /tmp may be empty, and
|
|
// the endpoint lists DIRECTORIES only — seed two so the listing is
|
|
// deterministic regardless of environment.
|
|
root := t.TempDir()
|
|
for _, name := range []string{"alpha", "beta"} {
|
|
if err := os.Mkdir(filepath.Join(root, name), 0o755); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
// A decoy file must NOT appear in the directory listing.
|
|
if err := os.WriteFile(filepath.Join(root, "stray.txt"), []byte("x"), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
req := httptest.NewRequest("GET", "/api/libraries/browse?path="+root, nil)
|
|
req.Header.Set("Authorization", "Bearer "+setup.Token)
|
|
rec := httptest.NewRecorder()
|
|
setup.Server.Config.Handler.ServeHTTP(rec, req)
|
|
assert.Equal(t, http.StatusOK, rec.Code)
|
|
|
|
var data struct {
|
|
CurrentPath string `json:"current_path"`
|
|
ParentPath string `json:"parent_path"`
|
|
Directories []string `json:"directories"`
|
|
}
|
|
err := json.Unmarshal(rec.Body.Bytes(), &data)
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, filepath.Clean(root), data.CurrentPath)
|
|
assert.ElementsMatch(t, []string{"alpha", "beta"}, data.Directories)
|
|
})
|
|
|
|
t.Run("GET /api/libraries/browse - blocks path traversal attempts", func(t *testing.T) {
|
|
req := httptest.NewRequest("GET", "/api/libraries/browse?path=/etc/../root", nil)
|
|
req.Header.Set("Authorization", "Bearer "+setup.Token)
|
|
rec := httptest.NewRecorder()
|
|
setup.Server.Config.Handler.ServeHTTP(rec, req)
|
|
assert.Equal(t, http.StatusBadRequest, rec.Code)
|
|
|
|
var errResp struct {
|
|
Error string `json:"error"`
|
|
}
|
|
json.Unmarshal(rec.Body.Bytes(), &errResp)
|
|
assert.Contains(t, errResp.Error, "path traversal not allowed")
|
|
})
|
|
}
|