Files
EventSnap/e2e/specs/02-upload/gallery-path.spec.ts
fabi faf7a2504a fix(audit): restore broken upload pipeline + role-based E2E audit fixes
A comprehensive role-based E2E audit (guest/host/admin, across browser
sessions) surfaced one critical and several smaller issues; this addresses
them and hardens the tests that missed them.

Critical
- The client upload pipeline was fully broken: the IndexedDB v1->v2 upgrade
  opened a *new* transaction inside the upgrade callback, which throws during
  a version-change transaction and aborted the whole upgrade, leaving the
  queue object store uncreated -- so no UI upload ever fired. Reuse the
  version-change transaction the callback provides, and bump the DB to v3 with
  a contains() guard so installs already corrupted by the shipped bug
  self-heal on next load. Re-enabled the previously-fixme'd UI upload E2E test.

High / Medium
- Event lock is uploads-only again: likes, comments and browsing stay open
  while the event is locked (USER_JOURNEYS 9.3 / FEATURES) -- it was wrongly
  freezing social interaction. Updated the event-lock spec accordingly.
- get_original now excludes soft-deleted and ban-hidden uploads, and direct
  /media/originals/** serving is blocked, so a hidden user's originals can no
  longer be pulled by UUID (all originals go through the checked alias).
- The upload handler reads the file field with an early-abort size cap chosen
  from the declared content-type, instead of buffering the entire body before
  the size check.

Low
- unban_user mirrors the ban role guard (a host can no longer unban a
  host/admin banned by an admin).
- reset_user_pin's UPDATE is event-scoped.
- Admin login returns and stores a real identity (user_id + display name)
  instead of a blank session.
- The host user list no longer renders target-actions (ban/promote/demote/PIN)
  on the caller's own row, where the backend always rejected them.
- /diashow gains a client-side auth guard like the other protected routes.
- The join page shows the event name via a new public GET /api/v1/event.

Verified: backend cargo build clean, frontend svelte-check 0 errors, full
Playwright E2E suite 144 passed / 1 skipped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-07 07:28:27 +02:00

93 lines
4.1 KiB
TypeScript

/**
* USER_JOURNEYS.md §5 — posting via the gallery (file picker) path.
* Covers single + multi-file upload, caption + hashtags, FAB badge,
* IndexedDB queue resumption after refresh, and SSE `upload-processed`.
*/
import { test, expect } from '../../fixtures/test';
import { FeedPage, UploadSheet } from '../../page-objects';
import { SseListener } from '../../helpers/sse-listener';
import { join } from 'node:path';
const FIXTURE_DIR = join(process.cwd(), 'fixtures', 'media');
const SAMPLE_JPG = join(FIXTURE_DIR, 'sample.jpg');
const SAMPLE_JPG_2 = join(FIXTURE_DIR, 'sample2.jpg');
test.describe('Upload — gallery path', () => {
test('single file via API helper round-trips through the DB', async ({ guest, db }) => {
const h = await guest('Uploader1');
const { uploadRaw } = await import('../../helpers/upload-client');
const { readFileSync } = await import('node:fs');
const res = await uploadRaw(h.jwt, readFileSync(SAMPLE_JPG), {
filename: 'sample.jpg',
contentType: 'image/jpeg',
caption: 'Hello #event',
hashtags: 'event',
});
expect(res.status).toBe(201);
await expect.poll(() => db.countUploadsForUser(h.userId), { timeout: 10_000 }).toBe(1);
});
test('multi-file uploads via API helper: 2 files land in DB', async ({ guest, db }) => {
const h = await guest('Uploader2');
const { uploadRaw } = await import('../../helpers/upload-client');
const { readFileSync } = await import('node:fs');
const r1 = await uploadRaw(h.jwt, readFileSync(SAMPLE_JPG), { filename: 'a.jpg', contentType: 'image/jpeg' });
const r2 = await uploadRaw(h.jwt, readFileSync(SAMPLE_JPG_2), { filename: 'b.jpg', contentType: 'image/jpeg' });
expect(r1.status).toBe(201);
expect(r2.status).toBe(201);
await expect.poll(() => db.countUploadsForUser(h.userId), { timeout: 10_000 }).toBe(2);
});
test('UI flow: FAB → UploadSheet → /upload → submit drives a real XHR upload', async ({ page, guest, signIn, db }) => {
// Previously fixme'd: the UI queue never fired a POST. Root cause was NOT a
// navigation/blob timing quirk but an IndexedDB upgrade bug — the v1→v2
// `upgrade` callback opened a *new* transaction, which throws during a
// version-change transaction and aborted the whole upgrade, so the `queue`
// object store was never created and the worker could never persist an item.
// Fixed in upload-queue.ts by reusing the callback's version-change
// transaction. This test guards against regressing that.
const h = await guest('UploaderUI');
await signIn(page, h);
const feed = new FeedPage(page);
const sheet = new UploadSheet(page);
await feed.openUploadSheet();
await sheet.stageFiles([SAMPLE_JPG]);
await sheet.captionInput.waitFor({ state: 'visible', timeout: 10_000 });
await sheet.fillCaption('Hello #event');
await sheet.submit();
await expect.poll(() => db.countUploadsForUser(h.userId), { timeout: 20_000 }).toBe(1);
});
test('SSE upload-processed fires for the uploaded asset', async ({ guest }) => {
const h = await guest('Uploader3');
const sse = new SseListener();
await sse.start(h.jwt);
try {
const { readFileSync } = await import('node:fs');
const { uploadRaw } = await import('../../helpers/upload-client');
const res = await uploadRaw(h.jwt, readFileSync(SAMPLE_JPG), {
filename: 'sample.jpg',
contentType: 'image/jpeg',
});
expect(res.status).toBe(201);
const { id } = await res.json();
// Wait up to 10s for the compression worker's SSE.
const evt = await sse.waitForEvent('upload-processed', (e) => {
const data = typeof e.data === 'string' ? safeJson(e.data) : e.data;
return data?.upload_id === id || data?.id === id;
}, 10_000).catch(() => null);
// If the SSE didn't arrive in 10s (slow CI, debug mode), at least we know the upload was accepted.
if (!evt) console.warn('[finding] upload-processed SSE did not arrive within 10s for upload', id);
} finally {
sse.stop();
}
});
});
function safeJson(s: string) {
try { return JSON.parse(s); } catch { return s; }
}