dbfd191bc5
Brand assets served at /api/files/v1/static had no cache headers. Introduce brand.Assets to own the embedded filesystem, content-hash ETags, and HTTP serving. Responses now carry Cache-Control and ETag so clients can cache and revalidate; stable email URLs stay revalidatable (max-age=3600, no immutable). Replace hardcoded Default*Path constants with StaticPathPrefix, logical filename constants, and StaticPath(). NewAssets validates required assets at startup so a rename fails fast instead of 404ing in sent emails. The files handler keeps routing and 404 rendering; ServeAssets sets cache headers and serves the file. Signed-off-by: Ludovic Vielle <ludovic@probo.com>
129 lines
3.7 KiB
Go
129 lines
3.7 KiB
Go
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice appear in all copies.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
// PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
package files_v1
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"go.gearno.de/kit/log"
|
|
"go.probo.inc/probo/pkg/securecookie"
|
|
)
|
|
|
|
func testHandler() *Handler {
|
|
return &Handler{
|
|
logger: log.NewLogger(log.WithOutput(io.Discard)),
|
|
}
|
|
}
|
|
|
|
func TestHandleGetPublicFile_InvalidGID(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
h := testHandler()
|
|
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/public/not-a-valid-gid", nil)
|
|
|
|
rctx := chi.NewRouteContext()
|
|
rctx.URLParams.Add("fileID", "not-a-valid-gid")
|
|
req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, rctx))
|
|
|
|
h.handleGetPublicFile(rec, req)
|
|
|
|
assert.Equal(t, http.StatusNotFound, rec.Code)
|
|
}
|
|
|
|
func TestHandleGetFile_InvalidGID(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
h := testHandler()
|
|
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/not-a-valid-gid", nil)
|
|
|
|
rctx := chi.NewRouteContext()
|
|
rctx.URLParams.Add("fileID", "not-a-valid-gid")
|
|
req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, rctx))
|
|
|
|
h.handleGetFile(rec, req)
|
|
|
|
assert.Equal(t, http.StatusNotFound, rec.Code)
|
|
}
|
|
|
|
func TestHandleGetStaticFile(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
mux := NewMux(
|
|
log.NewLogger(log.WithOutput(io.Discard)),
|
|
nil,
|
|
nil,
|
|
nil,
|
|
securecookie.Config{},
|
|
"test-secret",
|
|
)
|
|
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/static/probo.png", nil)
|
|
mux.ServeHTTP(rec, req)
|
|
|
|
require.Equal(t, http.StatusOK, rec.Code)
|
|
require.Contains(t, rec.Header().Get("Cache-Control"), "max-age=3600")
|
|
|
|
etag := rec.Header().Get("ETag")
|
|
require.NotEmpty(t, etag)
|
|
require.True(t, strings.HasPrefix(etag, `"`) && strings.HasSuffix(etag, `"`))
|
|
|
|
recNotModified := httptest.NewRecorder()
|
|
reqNotModified := httptest.NewRequest(http.MethodGet, "/static/probo.png", nil)
|
|
reqNotModified.Header.Set("If-None-Match", etag)
|
|
mux.ServeHTTP(recNotModified, reqNotModified)
|
|
|
|
require.Equal(t, http.StatusNotModified, recNotModified.Code)
|
|
|
|
recMissing := httptest.NewRecorder()
|
|
reqMissing := httptest.NewRequest(http.MethodGet, "/static/does-not-exist.png", nil)
|
|
mux.ServeHTTP(recMissing, reqMissing)
|
|
|
|
require.Equal(t, http.StatusNotFound, recMissing.Code)
|
|
}
|
|
|
|
func TestHandleGetFile_UnauthenticatedReturns401(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// NewMux with nil services — safe because auth middleware returns 401
|
|
// before any service is called when no credentials are present.
|
|
mux := NewMux(
|
|
log.NewLogger(log.WithOutput(io.Discard)),
|
|
nil, // fileSvc — not reached
|
|
nil, // proboSvc — not reached
|
|
nil, // iamSvc — not reached when no token/cookie present
|
|
securecookie.Config{},
|
|
"test-secret",
|
|
)
|
|
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/some-valid-looking-id", nil)
|
|
mux.ServeHTTP(rec, req)
|
|
|
|
assert.Equal(t, http.StatusUnauthorized, rec.Code)
|
|
}
|