fix(uploads): allow signed audio previews and compact destination details

services/api/internal/uploads/stream_test.go

@@ -0,0 +1,55 @@
+package uploads
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"pipu/api/internal/api/gen"
+	"pipu/api/internal/platform/sign"
+)
+
+func TestUploadStreamRangeAndAccel(t *testing.T) {
+	file := filepath.Join(t.TempDir(), "audio")
+	require.NoError(t, os.WriteFile(file, []byte("fLaC0123456789"), 0600))
+	req := httptest.NewRequest(http.MethodGet, "/audio", nil)
+	req.Header.Set("Range", "bytes=4-7")
+	rec := httptest.NewRecorder()
+	require.NoError(t, (uploadStream{req: req, file: file, format: "flac"}).VisitStreamUploadResponse(rec))
+	require.Equal(t, http.StatusPartialContent, rec.Code)
+	require.Equal(t, "audio/flac", rec.Header().Get("Content-Type"))
+	require.Equal(t, "bytes 4-7/14", rec.Header().Get("Content-Range"))
+	require.Equal(t, "0123", rec.Body.String())
+
+	rec = httptest.NewRecorder()
+	require.NoError(t, (uploadStream{format: "flac", xAccel: true, accel: "/_internal/uploads/batch/file"}).VisitStreamUploadResponse(rec))
+	require.Equal(t, http.StatusOK, rec.Code)
+	require.Equal(t, "/_internal/uploads/batch/file", rec.Header().Get("X-Accel-Redirect"))
+	require.Equal(t, "audio/flac", rec.Header().Get("Content-Type"))
+}
+
+func TestUploadStreamRejectsInvalidAndExpiredLinksBeforeReadingStaging(t *testing.T) {
+	signer, err := sign.New("")
+	require.NoError(t, err)
+	h := NewHandler(nil, signer, false)
+	id := uuid.New()
+	for _, expired := range []bool{false, true} {
+		exp := time.Now().Add(time.Hour).Unix()
+		sig := "invalid"
+		if expired {
+			exp = time.Now().Add(-time.Hour).Unix()
+			sig = signer.Sign("upload", id.String(), strconv.FormatInt(exp, 10))
+		}
+		res, err := h.StreamUpload(context.Background(), gen.StreamUploadRequestObject{Id: id, Params: gen.StreamUploadParams{Exp: exp, Sig: sig}})
+		require.Nil(t, res)
+		require.ErrorContains(t, err, "link is invalid or expired")
+	}
+}