/**
 * Regression for the review's CR2: export archives (Gallery.zip / Memories.zip)
 * were written under media_path/exports, and /media is a public ServeDir — so
 * anyone could GET /media/exports/Gallery.zip and download the whole gallery,
 * bypassing the ticket + export_*_ready gate. Exports now live OUTSIDE media_path
 * and are reachable only via the gated /api/v1/export/{zip,html} handlers (covered
 * by export.spec.ts). Here we assert the public path is dead.
 */
import { test, expect } from '../../fixtures/test';

const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';

test.describe('Export — no public leak (CR2)', () => {
  test('archives are not reachable through the public /media path', async () => {
    for (const name of ['Gallery.zip', 'Memories.zip']) {
      const res = await fetch(`${BASE}/media/exports/${name}`);
      // 404 (not 200): a 200 here would mean the whole-gallery archive is
      // downloadable without any auth — the CR2 data-exposure regression.
      expect(res.status).toBe(404);
    }
  });
});