From fc1e8e7ba8e9e9c0fd11954522ff4a1e9ca93282 Mon Sep 17 00:00:00 2001 From: Mathias Date: Sat, 3 Oct 2026 21:32:14 +0200 Subject: [PATCH] test(web): a foreign post to the recording delete route leaves the recording, on an app that mounts uploads (#37, #48) The earlier entry posted to an app without uploads, where the route does not exist, and stayed green with the route removed. This one seeds a finished row and goes red without the gate. Found by the PR #58 review. Co-Authored-By: Claude Sonnet 5.5 --- internal/web/crossorigin_test.go | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/internal/web/crossorigin_test.go b/internal/web/crossorigin_test.go index b75d832..df39745 100644 --- a/internal/web/crossorigin_test.go +++ b/internal/web/crossorigin_test.go @@ -113,7 +113,6 @@ func TestCrossOrigin_AForeignPostIsRefusedOnEachListedStateChangingPath(t *testi "/v/abc/summarize", "/v/abc/retry-now", "/v/abc/chat", - "/uploads/00000000-0000-0000-0000-000000000000/delete", } for _, path := range routes { t.Run(path, func(t *testing.T) { @@ -126,6 +125,20 @@ func TestCrossOrigin_AForeignPostIsRefusedOnEachListedStateChangingPath(t *testi } } +func TestCrossOrigin_ARefusedRecordingDeletePostLeavesTheRecordingInPlace(t *testing.T) { + for name, h := range foreign { + t.Run(name, func(t *testing.T) { + app, _ := newUploadApp(t, audioOK, 200<<20) + id := seedUpload(t, userID, "m", "done", "Synthetic transcript text.") + + rec := do(t, app, withHeaders(httptest.NewRequest(http.MethodPost, "/uploads/"+id+"/delete", nil), h)) + + assert.Equal(t, http.StatusForbidden, rec.Code) + assert.True(t, uploadExists(t, id), "a refused post must not delete the recording") + }) + } +} + // A login redirect comes back to /auth/callback as a cross-site GET navigation, and // health probes carry no headers: safe methods must never be refused on origin grounds. func TestCrossOrigin_ACrossSiteGETIsNotRefused(t *testing.T) {