|
81 | 81 | expect { perform_request.call }.to change(CodeOcean::File, :count).by(-1) |
82 | 82 | end |
83 | 83 | end |
| 84 | + |
| 85 | + describe 'GET #render_protected_upload' do |
| 86 | + let(:exercise) { create(:audio_video) } |
| 87 | + let(:submission) { create(:submission, exercise:, contributor: create(:external_user)) } |
| 88 | + let(:file) { exercise.files.detect {|f| f.file_type.file_extension == '.mp4' } } |
| 89 | + let(:token) { Rack::Utils.parse_nested_query(URI.parse(signed_url).query)['token'] } |
| 90 | + |
| 91 | + context 'with a valid signed URL and matching filename' do |
| 92 | + let(:signed_url) { AuthenticatedUrlHelper.sign(render_protected_upload_url(id: file, filename: file.filepath), file) } |
| 93 | + |
| 94 | + before do |
| 95 | + get :render_protected_upload, params: {id: file.id, filename: file.filepath, token:} |
| 96 | + end |
| 97 | + |
| 98 | + expect_assigns(file: :file) |
| 99 | + expect_redirect |
| 100 | + |
| 101 | + it 'redirects to ActiveStorage blob with inline disposition' do |
| 102 | + location = response.headers['Location'] || response.location |
| 103 | + expect(location).to include('disposition=inline') |
| 104 | + expect(location).to include(file.attachment.filename.to_s) |
| 105 | + end |
| 106 | + end |
| 107 | + |
| 108 | + context 'with a mismatching filename' do |
| 109 | + let(:signed_url) { AuthenticatedUrlHelper.sign(render_protected_upload_url(id: file, filename: file.filepath), file) } |
| 110 | + |
| 111 | + it 'returns unauthorized' do |
| 112 | + get :render_protected_upload, params: {id: file.id, filename: 'wrong/name.mp4', token:} |
| 113 | + expect(response).to have_http_status(:unauthorized) |
| 114 | + end |
| 115 | + end |
| 116 | + end |
84 | 117 | end |
0 commit comments