fix(uploads): allow signed audio previews and compact destination details

services/api/internal/auth/middleware_stream_test.go

@@ -0,0 +1,38 @@
+package auth_test
+
+import (
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"pipu/api/internal/auth"
+)
+
+func TestSignedUploadStreamReachesSignatureHandlerWithoutBearer(t *testing.T) {
+	const file = "/api/v1/admin/uploads/files/01a18459-32bc-7589-a83d-635292a7a4e2"
+	for _, tc := range []struct {
+		method, path string
+		want         int
+	}{
+		{http.MethodGet, file + "/stream?exp=1&sig=invalid", http.StatusForbidden},
+		{http.MethodHead, file + "/stream?exp=1&sig=invalid", http.StatusForbidden},
+		{http.MethodGet, file, http.StatusUnauthorized},
+		{http.MethodPatch, file + "/stream", http.StatusUnauthorized},
+		{http.MethodGet, file + "/stream/other", http.StatusUnauthorized},
+		{http.MethodGet, "/api/v1/admin/uploads", http.StatusUnauthorized},
+	} {
+		t.Run(tc.method+" "+tc.path, func(t *testing.T) {
+			h := auth.Middleware(nil, slog.New(slog.NewTextHandler(io.Discard, nil)))(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				// A signed media route still delegates authorization to its signature handler.
+				w.WriteHeader(http.StatusForbidden)
+			}))
+			rec := httptest.NewRecorder()
+			h.ServeHTTP(rec, httptest.NewRequest(tc.method, tc.path, nil))
+			require.Equal(t, tc.want, rec.Code)
+		})
+	}
+}