jakub/sm-bm-plugin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test: cover the realtime access guard and chat prefixes

Browse Source 
jz.bm.realtime-access admits chat-group members and, through
golem15.presentations' owner guard, presentation owners; everyone else
gets 401, 403 or 503 with Cache-Control no-cache, private. /_chat,
/_chatchannels and /_chatbots are reserved for the APIs.
This commit is contained in:
Jakub Zych
2026-10-26 15:48:07 +01:00
parent 0642fb1d08
commit cb7ba7ec8a
2 changed files with 128 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
static_test.go
View File

@@ -117,6 +117,8 @@ func TestStaticReservedPaths(t *testing.T) {
"/bmadmin", "/bmadmin/", "/bmadmin/login", "/storage/app/uploads/public/x.pdf",
"/storage", "/_user/../_user/x", "//_bm/api",
"/oauth", "/oauth/microsoft", "/oauth/microsoft/callback",
"/_chat", "/_chat/x", "/_chat/api/v1/conversations/1/messages",
"/_chatchannels", "/_chatchannels/x", "/_chatbots", "/_chatbots/x",
} {
rec := get(h, http.MethodGet, p, nil)
if rec.Code != http.StatusNotFound || strings.Contains(rec.Body.String(), "app") {
@@ -124,7 +126,7 @@ func TestStaticReservedPaths(t *testing.T) {
}
}
// Names that merely start like a reserved prefix are client routes.
for _, p := range []string{"/bmadmins", "/storage-info", "/_users", "/oauthy"} {
for _, p := range []string{"/bmadmins", "/storage-info", "/_users", "/oauthy", "/_chatty"} {
if rec := get(h, http.MethodGet, p, nil); rec.Code != http.StatusOK {
t.Fatalf("GET %s = %d, want the fallback", p, rec.Code)
}