mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-09-01 19:31:32 +09:00
Address review: assert uploaded bytes in disk update test
direct_upload_url_for now returns [blob, url] so the authenticated update test can assert blob.download matches the uploaded payload, not just the 204 status — guarding against a write landing at the wrong key or with the wrong content. Both update call sites destructure the tuple.
This commit is contained in:
@@ -35,14 +35,16 @@ class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTe
|
||||
end
|
||||
|
||||
test "disk update requires authentication" do
|
||||
put direct_upload_url_for("hello"), params: "hello", headers: { "Content-Type" => "text/plain" }
|
||||
_blob, url = direct_upload_url_for("hello")
|
||||
|
||||
put url, params: "hello", headers: { "Content-Type" => "text/plain" }
|
||||
|
||||
assert_redirected_to new_session_url
|
||||
end
|
||||
|
||||
test "disk update stores bytes for an authenticated session without a CSRF token" do
|
||||
sign_in :david
|
||||
url = direct_upload_url_for("hello")
|
||||
blob, url = direct_upload_url_for("hello")
|
||||
|
||||
# Forgery protection is off in test by default; turn it on so this proves the
|
||||
# signed-token service PUT stays CSRF-exempt even when the concern re-arms it.
|
||||
@@ -51,6 +53,7 @@ class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTe
|
||||
end
|
||||
|
||||
assert_response :no_content
|
||||
assert_equal "hello", blob.download
|
||||
end
|
||||
|
||||
private
|
||||
@@ -64,9 +67,10 @@ class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTe
|
||||
blob = ActiveStorage::Blob.create_before_direct_upload! \
|
||||
filename: "hello.txt", byte_size: content.bytesize, \
|
||||
checksum: Digest::MD5.base64digest(content), content_type: "text/plain"
|
||||
ActiveStorage::Current.set(url_options: { host: "once.campfire.test", protocol: "http" }) do
|
||||
url = ActiveStorage::Current.set(url_options: { host: "once.campfire.test", protocol: "http" }) do
|
||||
blob.service_url_for_direct_upload
|
||||
end
|
||||
[ blob, url ]
|
||||
end
|
||||
|
||||
def with_forgery_protection
|
||||
|
||||
Reference in New Issue
Block a user