feat(tenant-api): add desktop content asset endpoint scoped by tenant

Lets desktop clients fetch tenant images/articles assets via Bearer-auth without requiring the public asset signature, so stale-signed assets served from existing articles still load on the desktop side. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-27 12:20:54 +08:00
parent 7ddd3d0c6c
commit acf7738bdd
4 changed files with 151 additions and 0 deletions
@@ -0,0 +1,107 @@
+package transport
+
+import (
+	"context"
+	"encoding/base64"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/geo-platform/tenant-api/internal/bootstrap"
+	"github.com/geo-platform/tenant-api/internal/tenant/repository"
+)
+
+type fakeAssetObjectStorage struct {
+	content []byte
+	gotKey  string
+}
+
+func (s *fakeAssetObjectStorage) Validate() error {
+	return nil
+}
+
+func (s *fakeAssetObjectStorage) PutBytes(context.Context, string, []byte, string) error {
+	panic("unexpected call")
+}
+
+func (s *fakeAssetObjectStorage) GetBytes(_ context.Context, objectKey string) ([]byte, error) {
+	s.gotKey = objectKey
+	return s.content, nil
+}
+
+func (s *fakeAssetObjectStorage) Exists(context.Context, string) (bool, error) {
+	panic("unexpected call")
+}
+
+func (s *fakeAssetObjectStorage) Delete(context.Context, string) error {
+	panic("unexpected call")
+}
+
+func (s *fakeAssetObjectStorage) PublicURL(string) (string, error) {
+	panic("unexpected call")
+}
+
+func TestAssetHandlerServeDesktop_AllowsStaleSignedTenantAsset(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	objectKey := "tenants/7/images/test.webp"
+	storage := &fakeAssetObjectStorage{content: mustDecodeBase64(t, "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/p9sAAAAASUVORK5CYII=")}
+	handler := &AssetHandler{
+		secret: "current-secret",
+		app:    &bootstrap.App{ObjectStorage: storage},
+	}
+	staleToken := (&AssetHandler{secret: "old-secret"}).signObjectKey(objectKey)
+
+	router := gin.New()
+	router.GET("/api/desktop/content/assets/:token", func(c *gin.Context) {
+		ctx := WithDesktopClient(c.Request.Context(), &repository.DesktopClient{TenantID: 7})
+		c.Request = c.Request.WithContext(ctx)
+		handler.ServeDesktop(c)
+	})
+
+	resp := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/desktop/content/assets/"+staleToken+"?format=png", nil)
+	router.ServeHTTP(resp, req)
+
+	assert.Equal(t, http.StatusOK, resp.Code)
+	assert.Equal(t, objectKey, storage.gotKey)
+	assert.Equal(t, "image/png", resp.Header().Get("Content-Type"))
+}
+
+func TestAssetHandlerServeDesktop_RejectsOtherTenantAsset(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	storage := &fakeAssetObjectStorage{content: []byte("not used")}
+	handler := &AssetHandler{
+		secret: "current-secret",
+		app:    &bootstrap.App{ObjectStorage: storage},
+	}
+	token := (&AssetHandler{secret: "old-secret"}).signObjectKey("tenants/8/images/test.webp")
+
+	router := gin.New()
+	router.GET("/api/desktop/content/assets/:token", func(c *gin.Context) {
+		ctx := WithDesktopClient(c.Request.Context(), &repository.DesktopClient{TenantID: 7})
+		c.Request = c.Request.WithContext(ctx)
+		handler.ServeDesktop(c)
+	})
+
+	resp := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/desktop/content/assets/"+token, nil)
+	router.ServeHTTP(resp, req)
+
+	assert.Equal(t, http.StatusNotFound, resp.Code)
+	assert.Empty(t, storage.gotKey)
+}
+
+func mustDecodeBase64(t *testing.T, value string) []byte {
+	t.Helper()
+
+	data, err := base64.StdEncoding.DecodeString(value)
+	if err != nil {
+		t.Fatalf("decode base64 fixture: %v", err)
+	}
+	return data
+}