ajyy/backend/tests/test_upload.py

"""Public attachment upload (local storage)."""
import pytest

from app.core.config import get_settings


@pytest.fixture
def local_storage_env(tmp_path, monkeypatch):
    monkeypatch.setenv("STORAGE_TYPE", "local")
    monkeypatch.setenv("LOCAL_STORAGE_DIR", str(tmp_path))
    get_settings.cache_clear()
    yield tmp_path
    get_settings.cache_clear()


def test_public_upload(client, local_storage_env):
    files = {"file": ("a.png", b"fake-png-bytes", "image/png")}
    r = client.post("/api/public/attachment/upload", files=files)
    assert r.status_code == 200
    data = r.json()["data"]
    assert data["url"]
    assert data["id"]
    assert data["fileName"] == "a.png"
    assert data["size"] == len(b"fake-png-bytes")
    assert data["url"].startswith("/uploads/")


def test_public_upload_rejects_path_traversal(client, local_storage_env):
    base = local_storage_env
    outside = (base / ".." / "outside").resolve()
    assert not outside.exists()

    files = {"file": ("evil.png", b"evil-bytes", "image/png")}
    r = client.post(
        "/api/public/attachment/upload",
        files=files,
        data={"folder": "../outside"},
    )
    assert r.status_code == 400
    body = r.json()
    assert body["code"] == 400
    assert "message" in body
    assert "detail" not in body
    assert not outside.exists()
    assert not any(base.rglob("*"))