1
import { env } from "cloudflare:workers";
2
import { beforeEach, describe, expect, it } from "vitest";
3
 
4
import { apiRequest } from "@tests/worker/helpers/request";
5
import { refreshCookieFor } from "@tests/worker/helpers/auth";
6
import { resetD1Tables } from "@tests/worker/helpers/db";
7
import { ApiErrorResponse } from "@tests/worker/helpers/schemas";
8
import { seedPage, seedPageShare, seedUpload, seedUser, seedWorkspace } from "@tests/worker/helpers/seeds";
9
 
10
async function putR2(key: string, bytes: Uint8Array) {
11
  await env.R2.put(key, bytes);
12
}
13
 
14
async function resetR2() {
15
  let cursor: string | undefined;
16
  do {
17
    const list = await env.R2.list({ cursor });
18
    if (list.objects.length > 0) {
19
      await env.R2.delete(list.objects.map((o) => o.key));
20
    }
21
    cursor = list.truncated ? list.cursor : undefined;
22
  } while (cursor);
23
}
24
 
25
describe("GET /uploads/:id - archived page gating", () => {
26
  beforeEach(async () => {
27
    await resetD1Tables();
28
    await resetR2();
29
  });
30
 
31
  it("returns 404 for page-scoped uploads when the linked page is archived (member via cookie)", async () => {
32
    const owner = await seedUser();
33
    const ws = await seedWorkspace({ owner_id: owner.id });
34
    const archivedPage = await seedPage({
35
      workspace_id: ws.id,
36
      created_by: owner.id,
37
      archived_at: "2026-04-01T00:00:00.000Z",
38
    });
39
    const upload = await seedUpload({
40
      workspace_id: ws.id,
41
      page_id: archivedPage.id,
42
      uploaded_by: owner.id,
43
      r2_key: "uploads/archived-page-asset.png",
44
    });
45
    await putR2(upload.r2_key, new Uint8Array([1, 2, 3]));
46
 
47
    const cookie = await refreshCookieFor(owner.id);
48
    const res = await apiRequest(`/uploads/${upload.id}`, { cookie });
49
 
50
    expect(res.status).toBe(404);
51
    expect(ApiErrorResponse.parse(await res.json()).error).toBe("not_found");
52
  });
53
 
54
  it("serves workspace-level uploads (no page_id) for any authenticated member without archive checks", async () => {
55
    const owner = await seedUser();
56
    const ws = await seedWorkspace({ owner_id: owner.id });
57
    const upload = await seedUpload({
58
      workspace_id: ws.id,
59
      page_id: null,
60
      uploaded_by: owner.id,
61
      r2_key: "uploads/avatar.png",
62
      content_type: "image/png",
63
    });
64
    await putR2(upload.r2_key, new Uint8Array([9, 8, 7]));
65
 
66
    const cookie = await refreshCookieFor(owner.id);
67
    const res = await apiRequest(`/uploads/${upload.id}`, { cookie });
68
 
69
    expect(res.status).toBe(200);
70
    expect(res.headers.get("content-type")).toBe("image/png");
71
    expect(res.headers.get("cache-control")).toContain("immutable");
72
  });
73
 
74
  it("returns 404 for archived page-scoped uploads accessed via share token", async () => {
75
    const owner = await seedUser();
76
    const ws = await seedWorkspace({ owner_id: owner.id });
77
    const archivedPage = await seedPage({
78
      workspace_id: ws.id,
79
      created_by: owner.id,
80
      archived_at: "2026-04-01T00:00:00.000Z",
81
    });
82
    await seedPageShare({
83
      page_id: archivedPage.id,
84
      created_by: owner.id,
85
      grantee_type: "link",
86
      grantee_id: null,
87
      link_token: "tok-archived",
88
      permission: "view",
89
    });
90
    const upload = await seedUpload({
91
      workspace_id: ws.id,
92
      page_id: archivedPage.id,
93
      uploaded_by: owner.id,
94
      r2_key: "uploads/share-archived.png",
95
    });
96
    await putR2(upload.r2_key, new Uint8Array([4, 5, 6]));
97
 
98
    const res = await apiRequest(`/uploads/${upload.id}`, { shareToken: "tok-archived" });
99
    expect(res.status).toBe(404);
100
    expect(ApiErrorResponse.parse(await res.json()).error).toBe("not_found");
101
  });
102
 
103
  it("serves page-scoped uploads for members when the page is not archived", async () => {
104
    const owner = await seedUser();
105
    const ws = await seedWorkspace({ owner_id: owner.id });
106
    const page = await seedPage({ workspace_id: ws.id, created_by: owner.id });
107
    const upload = await seedUpload({
108
      workspace_id: ws.id,
109
      page_id: page.id,
110
      uploaded_by: owner.id,
111
      r2_key: "uploads/live-page-asset.png",
112
      content_type: "image/png",
113
    });
114
    await putR2(upload.r2_key, new Uint8Array([2, 4, 6, 8]));
115
 
116
    const cookie = await refreshCookieFor(owner.id);
117
    const res = await apiRequest(`/uploads/${upload.id}`, { cookie });
118
    expect(res.status).toBe(200);
119
    expect(res.headers.get("content-type")).toBe("image/png");
120
    expect(res.headers.get("cache-control")).toContain("private");
121
    expect(res.headers.get("cache-control")).toContain("max-age=300");
122
  });
123
});