203 lines
7.9 KiB
TypeScript
203 lines
7.9 KiB
TypeScript
import { describe, it, expect, vi, beforeEach } from 'vitest';
|
|
import { NextRequest } from 'next/server';
|
|
import { GET } from '../[id]/route';
|
|
import { encodeAssetId } from '@/lib/tokens';
|
|
import { immich, ImmichUnavailableError } from '@/lib/immich';
|
|
|
|
const published = vi.hoisted(() => ({ value: true, asked: [] as string[] }));
|
|
vi.mock('@/lib/publishedAssets', () => ({
|
|
isPublishedAsset: async (id: string) => {
|
|
published.asked.push(id);
|
|
return published.value;
|
|
},
|
|
}));
|
|
vi.mock('@/lib/admin/auth', () => ({
|
|
isAdminAuthenticated: async () => false,
|
|
}));
|
|
|
|
vi.mock('@/lib/immich', async () => {
|
|
const actual = await vi.importActual<typeof import('@/lib/immich')>('@/lib/immich');
|
|
return {
|
|
// Keep the real error class — the route branches on `instanceof`.
|
|
ImmichUnavailableError: actual.ImmichUnavailableError,
|
|
immich: { streamAsset: vi.fn() },
|
|
};
|
|
});
|
|
|
|
const mockStream = immich.streamAsset as unknown as ReturnType<typeof vi.fn>;
|
|
|
|
const ASSET_ID = '11111111-2222-3333-4444-555555555555';
|
|
|
|
/** Stream stub — the route only forwards the body, it never reads it. */
|
|
function fakeBody(contentType: string) {
|
|
return {
|
|
stream: new ReadableStream({
|
|
start(controller) {
|
|
controller.enqueue(new Uint8Array([1, 2, 3]));
|
|
controller.close();
|
|
},
|
|
}),
|
|
contentType,
|
|
contentLength: '3',
|
|
};
|
|
}
|
|
|
|
function call(token: string, query = '', headers?: Record<string, string>) {
|
|
const req = new NextRequest(`http://localhost/api/image/${token}${query}`, { headers });
|
|
return GET(req, { params: Promise.resolve({ id: token }) });
|
|
}
|
|
|
|
describe('GET /api/image/[id]', () => {
|
|
beforeEach(() => {
|
|
vi.clearAllMocks();
|
|
});
|
|
|
|
it('rejects a raw Immich UUID instead of an encoded token', async () => {
|
|
const res = await call(ASSET_ID);
|
|
expect(res.status).toBe(400);
|
|
expect(mockStream).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('rejects a syntactically broken token', async () => {
|
|
const res = await call('v2:not-valid-base64url!!');
|
|
expect(res.status).toBe(400);
|
|
expect(mockStream).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('refuses an asset the site no longer shows, without caching the refusal', async () => {
|
|
published.value = false;
|
|
try {
|
|
const res = await call(encodeAssetId(ASSET_ID));
|
|
expect(res.status).toBe(404);
|
|
expect(res.headers.get('Cache-Control')).toBe('no-store');
|
|
expect(mockStream).not.toHaveBeenCalled();
|
|
} finally {
|
|
published.value = true;
|
|
}
|
|
});
|
|
|
|
it('serves a valid token', async () => {
|
|
mockStream.mockResolvedValue(fakeBody('image/jpeg'));
|
|
const res = await call(encodeAssetId(ASSET_ID));
|
|
expect(res.status).toBe(200);
|
|
expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'preview', true);
|
|
});
|
|
|
|
describe('photos edited in Immich (#831)', () => {
|
|
beforeEach(() => {
|
|
published.asked = [];
|
|
});
|
|
|
|
it('asks Immich for the edit when the URL carries the edit marker', async () => {
|
|
mockStream.mockResolvedValue(fakeBody('image/jpeg'));
|
|
const res = await call(encodeAssetId(ASSET_ID), '?size=preview&e=mf3k2abc');
|
|
expect(res.status).toBe(200);
|
|
expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'preview', true);
|
|
});
|
|
|
|
it('asks for the edited thumbnail too', async () => {
|
|
mockStream.mockResolvedValue(fakeBody('image/webp'));
|
|
await call(encodeAssetId(ASSET_ID), '?size=thumbnail&e=mf3k2abc');
|
|
expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'thumbnail', true);
|
|
});
|
|
|
|
it('shows the edit to a URL stripped of its marker: the server decides, not the URL', async () => {
|
|
// Review of #832: with the marker as the switch, dropping `&e=` from a
|
|
// URL brought back what the photographer had cropped out.
|
|
mockStream.mockResolvedValue(fakeBody('image/jpeg'));
|
|
await call(encodeAssetId(ASSET_ID), '?size=preview&w=1440');
|
|
expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'preview', true);
|
|
mockStream.mockResolvedValue(fakeBody('image/webp'));
|
|
await call(encodeAssetId(ASSET_ID), '?size=thumbnail');
|
|
expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'thumbnail', true);
|
|
expect(mockStream).not.toHaveBeenCalledWith(ASSET_ID, expect.anything(), false);
|
|
});
|
|
|
|
it('is still gated by the published-asset check, which goes by the asset alone', async () => {
|
|
mockStream.mockResolvedValue(fakeBody('image/jpeg'));
|
|
const res = await call(encodeAssetId(ASSET_ID), '?size=preview&e=mf3k2abc&w=1440');
|
|
expect(res.status).toBe(200);
|
|
expect(published.asked).toEqual([ASSET_ID]);
|
|
|
|
published.value = false;
|
|
try {
|
|
const refused = await call(encodeAssetId(ASSET_ID), '?size=preview&e=mf3k2abc');
|
|
expect(refused.status).toBe(404);
|
|
} finally {
|
|
published.value = true;
|
|
}
|
|
});
|
|
|
|
it('gives the edited rendition its own ETag', async () => {
|
|
mockStream.mockResolvedValue(fakeBody('image/jpeg'));
|
|
const token = encodeAssetId(ASSET_ID);
|
|
const plain = (await call(token, '?size=preview')).headers.get('ETag');
|
|
mockStream.mockResolvedValue(fakeBody('image/jpeg'));
|
|
const edited = (await call(token, '?size=preview&e=mf3k2abc')).headers.get('ETag');
|
|
mockStream.mockResolvedValue(fakeBody('image/jpeg'));
|
|
const reEdited = (await call(token, '?size=preview&e=mf9zz001')).headers.get('ETag');
|
|
expect(new Set([plain, edited, reEdited]).size).toBe(3);
|
|
});
|
|
|
|
it('ignores a marker that is not one, and keeps it out of the ETag', async () => {
|
|
mockStream.mockResolvedValue(fakeBody('image/jpeg'));
|
|
const token = encodeAssetId(ASSET_ID);
|
|
const res = await call(token, `?size=preview&e=${encodeURIComponent('"x", W/"y')}`);
|
|
expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'preview', true);
|
|
expect(res.headers.get('ETag')).not.toContain('y');
|
|
});
|
|
});
|
|
|
|
// Regression guard for the stored-XSS fix in c2fa8e7. An SVG served as
|
|
// image/svg+xml executes script in the browser under our own origin.
|
|
// This logic lives in the route and cannot be extracted the way
|
|
// lib/imageSize.ts was, so a route-level test is the only way to pin it.
|
|
it.each([
|
|
['image/svg+xml', 'application/octet-stream'],
|
|
['text/xml', 'application/octet-stream'],
|
|
['text/html', 'application/octet-stream'],
|
|
['application/octet-stream', 'image/jpeg'],
|
|
['image/jpeg', 'image/jpeg'],
|
|
['image/webp', 'image/webp'],
|
|
])('rewrites upstream Content-Type %s to %s', async (upstream, expected) => {
|
|
mockStream.mockResolvedValue(fakeBody(upstream));
|
|
const res = await call(encodeAssetId(ASSET_ID));
|
|
expect(res.headers.get('Content-Type')).toBe(expected);
|
|
});
|
|
|
|
it('returns 304 with no body when the ETag matches', async () => {
|
|
mockStream.mockResolvedValue(fakeBody('image/jpeg'));
|
|
const token = encodeAssetId(ASSET_ID);
|
|
|
|
const first = await call(token);
|
|
const etag = first.headers.get('ETag');
|
|
expect(etag).toBeTruthy();
|
|
|
|
const res = await call(token, '', { 'if-none-match': etag as string });
|
|
expect(res.status).toBe(304);
|
|
expect(await res.text()).toBe('');
|
|
});
|
|
|
|
it('never leaks the raw asset UUID in response headers', async () => {
|
|
mockStream.mockResolvedValue(fakeBody('image/jpeg'));
|
|
const res = await call(encodeAssetId(ASSET_ID));
|
|
const headerDump = JSON.stringify([...res.headers.entries()]);
|
|
expect(headerDump).not.toContain(ASSET_ID);
|
|
});
|
|
|
|
it('404s when the asset is genuinely gone', async () => {
|
|
mockStream.mockResolvedValue(null);
|
|
const res = await call(encodeAssetId(ASSET_ID));
|
|
expect(res.status).toBe(404);
|
|
expect(res.headers.get('Cache-Control')).toBe('no-store');
|
|
});
|
|
|
|
it('503s when Immich is unavailable, and does not let it be cached', async () => {
|
|
mockStream.mockRejectedValue(new ImmichUnavailableError('upstream down'));
|
|
const res = await call(encodeAssetId(ASSET_ID));
|
|
expect(res.status).toBe(503);
|
|
expect(res.headers.get('Cache-Control')).toBe('no-store');
|
|
expect(res.headers.get('Retry-After')).toBeTruthy();
|
|
});
|
|
});
|