From 0141eae018ac0695d779026b6a6e7686f108949e Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 15 Jun 2026 13:24:38 -0700 Subject: [PATCH] Address review: assert uploaded bytes in disk update test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit direct_upload_url_for now returns [blob, url] so the authenticated update test can assert blob.download matches the uploaded payload, not just the 204 status — guarding against a write landing at the wrong key or with the wrong content. Both update call sites destructure the tuple. --- .../active_storage/direct_uploads_controller_test.rb | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/test/controllers/active_storage/direct_uploads_controller_test.rb b/test/controllers/active_storage/direct_uploads_controller_test.rb index 7765839..416eb29 100644 --- a/test/controllers/active_storage/direct_uploads_controller_test.rb +++ b/test/controllers/active_storage/direct_uploads_controller_test.rb @@ -35,14 +35,16 @@ class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTe end test "disk update requires authentication" do - put direct_upload_url_for("hello"), params: "hello", headers: { "Content-Type" => "text/plain" } + _blob, url = direct_upload_url_for("hello") + + put url, params: "hello", headers: { "Content-Type" => "text/plain" } assert_redirected_to new_session_url end test "disk update stores bytes for an authenticated session without a CSRF token" do sign_in :david - url = direct_upload_url_for("hello") + blob, url = direct_upload_url_for("hello") # Forgery protection is off in test by default; turn it on so this proves the # signed-token service PUT stays CSRF-exempt even when the concern re-arms it. @@ -51,6 +53,7 @@ class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTe end assert_response :no_content + assert_equal "hello", blob.download end private @@ -64,9 +67,10 @@ class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTe blob = ActiveStorage::Blob.create_before_direct_upload! \ filename: "hello.txt", byte_size: content.bytesize, \ checksum: Digest::MD5.base64digest(content), content_type: "text/plain" - ActiveStorage::Current.set(url_options: { host: "once.campfire.test", protocol: "http" }) do + url = ActiveStorage::Current.set(url_options: { host: "once.campfire.test", protocol: "http" }) do blob.service_url_for_direct_upload end + [ blob, url ] end def with_forgery_protection