fix(05): CR-01 serve thumb URLs from the validated path key

lagoon/attach/static_test.go

@@ -69,3 +69,48 @@ func TestStaticHandler(t *testing.T) {
 		}
 	}
 }
+
+func TestStaticHandlerServesThumbURL(t *testing.T) {
+	ctx := t.Context()
+	bucket := memblob.OpenBucket(nil)
+	t.Cleanup(func() { _ = bucket.Close() })
+
+	f := &File{ID: 42, DiskName: "abc123xyz.jpg"}
+	if err := bucket.WriteAll(ctx, BlobKey(f.DiskName), testJPEG(t), &blob.WriterOptions{ContentType: "image/jpeg"}); err != nil {
+		t.Fatal(err)
+	}
+	thumbURL, err := f.Thumb(ctx, bucket, 200, 200, "crop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	const wantURL = "/storage/uploads/abc/123/xyz/thumb_42_200_200_0_0_crop.jpg"
+	if thumbURL != wantURL {
+		t.Fatalf("Thumb URL = %q, want %q", thumbURL, wantURL)
+	}
+
+	h := StaticHandler(bucket, "/storage/uploads")
+	srv := httptest.NewServer(h)
+	t.Cleanup(srv.Close)
+
+	res, err := http.Get(srv.URL + thumbURL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		t.Fatalf("thumb GET status = %d, want 200", res.StatusCode)
+	}
+	body, err := io.ReadAll(res.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(body) == 0 {
+		t.Fatal("thumb body is empty")
+	}
+
+	mismatch := httptest.NewRecorder()
+	h.ServeHTTP(mismatch, httptest.NewRequest(http.MethodGet, "/storage/uploads/foo/bar/baz/abc123xyz.jpg", nil))
+	if mismatch.Code != http.StatusNotFound {
+		t.Fatalf("mismatched original partition status = %d, want 404", mismatch.Code)
+	}
+}