bterkuile/fizzy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Cover bearer-authenticated export download URLs

Browse Source
This commit is contained in:
Rob Zolkos
2026-04-08 14:41:32 -04:00
parent 5e154a767f
commit 4a91e45aa5
2 changed files with 27 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/active_storage_authorization_test.rb
+8 -7
View File
@@ -18,7 +18,9 @@ class ActiveStorageAuthorizationTest < ActionDispatch::IntegrationTest
end
test "bearer token with board access can view blob" do
get rails_blob_path(@blob, disposition: :inline), env: bearer_token_env(identity_access_tokens(:davids_api_token).token)
bearer_token = { "HTTP_AUTHORIZATION" => "Bearer #{identity_access_tokens(:davids_api_token).token}" }
get rails_blob_path(@blob, disposition: :inline), env: bearer_token
assert_response :redirect
assert_match %r{rails/active_storage}, response.location
@@ -46,7 +48,9 @@ class ActiveStorageAuthorizationTest < ActionDispatch::IntegrationTest
end
test "bearer token with board access can view representation" do
get rails_representation_path(@blob.representation(resize_to_limit: [ 100, 100 ])), env: bearer_token_env(identity_access_tokens(:davids_api_token).token)
bearer_token = { "HTTP_AUTHORIZATION" => "Bearer #{identity_access_tokens(:davids_api_token).token}" }
get rails_representation_path(@blob.representation(resize_to_limit: [ 100, 100 ])), env: bearer_token
assert_response :redirect
assert_match %r{rails/active_storage/}, response.location
@@ -210,8 +214,9 @@ class ActiveStorageAuthorizationTest < ActionDispatch::IntegrationTest
test "export owner can download their export with bearer token" do
blob = create_export_blob_for(users(:david))
bearer_token = { "HTTP_AUTHORIZATION" => "Bearer #{identity_access_tokens(:davids_api_token).token}" }
get rails_blob_path(blob, disposition: :attachment), env: bearer_token_env(identity_access_tokens(:davids_api_token).token)
get rails_blob_path(blob, disposition: :attachment), env: bearer_token
assert_response :redirect
assert_match %r{rails/active_storage}, response.location
@@ -272,8 +277,4 @@ class ActiveStorageAuthorizationTest < ActionDispatch::IntegrationTest
user.avatar.blob
end
end
def bearer_token_env(token)
{ "HTTP_AUTHORIZATION" => "Bearer #{token}" }
end
end