test(14.2-04): uploads mount and access log unit tests; the uploads route owns its prefix

- TestUploadsMount: key off registers nothing; on, a public blob is served
  with its content type and nosniff, HEAD has no body, private, missing,
  partition and encoded traversal paths 404, an unpublished bucket or
  database 404s, a custom prefix is honoured
- mountUploads refuses a plugin route at or under the prefix, so
  BuildRouter fails instead of only an identical pattern failing at
  Assemble (README and storage docs updated)
- TestAccessLog: pattern and status for 200, handler 404 and recovered
  panic, path only for unmatched requests, locale-prefixed requests keep
  the pattern, integer duration_ms, no query, header or Authorization
  value, ResponseController flush still works

modules/surf/uploads.go

@@ -1,6 +1,7 @@
 package surf
 
 import (
+	"fmt"
 	"net/http"
 	"strings"
 
@@ -24,7 +25,9 @@ const defaultUploadsPrefix = "/storage/uploads"
 // and adds X-Content-Type-Options: nosniff because the files are served on
 // the app origin. The bucket and the database are looked up per request:
 // boot and route:list build the router before serve publishes either.
-// With the key false or absent nothing is registered.
+// The route owns the whole prefix: a plugin route at or under it fails
+// BuildRouter, as a route under the admin prefix does. With the key false
+// or absent nothing is registered and nothing is checked.
 func mountUploads(r *Router, app *backpack.App) error {
 	if r == nil || app == nil || app.Config == nil {
 		return nil
@@ -36,6 +39,11 @@ func mountUploads(r *Router, app *backpack.App) error {
 	if prefix == "" {
 		prefix = defaultUploadsPrefix
 	}
+	for _, rt := range r.routes {
+		if rt.path == prefix || strings.HasPrefix(rt.path, prefix+"/") {
+			return fmt.Errorf("surf: route %s %s (plugin %q) is under the uploads prefix storage.uploads.public_path_prefix %s, which storage.uploads.serve mounts", rt.method, rt.path, rt.pluginID, prefix)
+		}
+	}
 	handler := uploadsHandler(app, prefix)
 	r.BindPlugin(uploadsPluginID)
 	r.GroupRaw(prefix, nil, func(g pact.Router) {