Address review: assert uploaded bytes in disk update test

direct_upload_url_for now returns [blob, url] so the authenticated update
test can assert blob.download matches the uploaded payload, not just the
204 status — guarding against a write landing at the wrong key or with the
wrong content. Both update call sites destructure the tuple.
This commit is contained in:
Jeremy Daer
2026-06-15 13:24:38 -07:00
parent c49c41a0d7
commit 0141eae018
@@ -35,14 +35,16 @@ class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTe
end
test "disk update requires authentication" do
put direct_upload_url_for("hello"), params: "hello", headers: { "Content-Type" => "text/plain" }
_blob, url = direct_upload_url_for("hello")
put url, params: "hello", headers: { "Content-Type" => "text/plain" }
assert_redirected_to new_session_url
end
test "disk update stores bytes for an authenticated session without a CSRF token" do
sign_in :david
url = direct_upload_url_for("hello")
blob, url = direct_upload_url_for("hello")
# Forgery protection is off in test by default; turn it on so this proves the
# signed-token service PUT stays CSRF-exempt even when the concern re-arms it.
@@ -51,6 +53,7 @@ class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTe
end
assert_response :no_content
assert_equal "hello", blob.download
end
private
@@ -64,9 +67,10 @@ class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTe
blob = ActiveStorage::Blob.create_before_direct_upload! \
filename: "hello.txt", byte_size: content.bytesize, \
checksum: Digest::MD5.base64digest(content), content_type: "text/plain"
ActiveStorage::Current.set(url_options: { host: "once.campfire.test", protocol: "http" }) do
url = ActiveStorage::Current.set(url_options: { host: "once.campfire.test", protocol: "http" }) do
blob.service_url_for_direct_upload
end
[ blob, url ]
end
def with_forgery_protection