From 5368d5f8c28357e4675cbce2ee39f158ddd4ae75 Mon Sep 17 00:00:00 2001 From: Mathias Date: Thu, 1 Oct 2026 19:28:06 +0200 Subject: [PATCH] test(web): a rejected upload is logged with its reason, never the filename or title (red) Rejections are synchronous and leave no row, so an operator could not tell 'the user never retried' from 'the page refused it' (it happened during the first real-recording trial). The reason is operational; the filename and title are the user's private content. Co-Authored-By: Claude Sonnet 5.5 --- internal/web/uploads_handler_test.go | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/internal/web/uploads_handler_test.go b/internal/web/uploads_handler_test.go index 1b9fdcd..a94400a 100644 --- a/internal/web/uploads_handler_test.go +++ b/internal/web/uploads_handler_test.go @@ -3,6 +3,7 @@ package web_test import ( "bytes" "context" + "log/slog" "mime/multipart" "net/http" "net/http/httptest" @@ -336,3 +337,21 @@ func TestUploadPage_AlsoCarriesTheVideoNotice(t *testing.T) { assert.Contains(t, body(t, do(t, app, get("/uploads/"+id))), "Only its audio was used") } + +func TestUploadPost_ARejectionIsLoggedWithItsReasonAndNeverTheFilenameOrTitle(t *testing.T) { + // Rejections are synchronous and leave no row, so without a log line an operator + // cannot tell "the user never retried" from "the page refused it". The reason is + // operational; the filename and title are the user's private content. + var buf bytes.Buffer + app, _ := newUploadApp(t, uploads.Probe{Duration: time.Minute, HasVideo: true}, 1<<20) + app.Log = slog.New(slog.NewTextHandler(&buf, nil)) + + rec := do(t, app, uploadReq(t, "Secret project notes", "client-acme-roadmap.mp4", []byte("x"))) + + require.Equal(t, http.StatusUnprocessableEntity, rec.Code) + logged := buf.String() + assert.Contains(t, logged, "upload rejected") + assert.Contains(t, logged, "reason=no_audio") + assert.NotContains(t, logged, "Secret project notes", "the title is private content") + assert.NotContains(t, logged, "client-acme-roadmap", "the filename is private content") +}