Repository navigation
Protect public links, an integration suite, and the bugs it found - #95
Merged
Merged
Conversation
Wrapping every body in io.LimitReader hid its length, so PUT and PATCH bodies went out chunked, and the API read them as empty. UpdateMetadata never stored anything. Bodies of known length now go as they are. The test transport kept losing the length too, which is why no test noticed.
BatchCopyMoveOptions.Overwrite was ignored. And WaitForBatchOperation polled every returned link as an operation, but a copy that finishes at once returns a link to the file, so waiting failed with "Operation not found".
Built on what the live API does, which differs from its reference: settings sent with publishing are ignored, so they follow in a PATCH; the expiry is a Unix time, not a duration; and an access needs a type. PublishResourceWithSettings unpublishes again if the settings fail, so a link meant to be protected is never left open. Address access is for Yandex 360 for business, and forbidding downloads is not available through the public API; the docs say both.
Behind the integration build tag. It works in a new folder it deletes for good at the end, and a guard in the HTTP transport refuses any change outside it, any trash item it did not create, and emptying the whole trash. It checks link protection as a stranger without a token would. CONTRIBUTING explains how to run it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
An integration suite against the real API, which found three bugs the
unit tests missed:
And public link protection: a password and an expiry.
Public link settings, as the API really behaves
Worked out on a paid personal account and checked as a stranger
without a token, plus in a browser:
Where the reference is wrong: settings sent with publishing are
ignored, available_until is a Unix time rather than a duration, and an
access needs "type". Address access is for Yandex 360 for business; on
a personal account it closes the link to everyone.
The integration suite
Behind the integration build tag, so go test ./... skips it. It works
in a new disk:/disk-it- folder that it deletes for good, and a
guard in the HTTP transport refuses any change outside it, any trash
item it did not create, and emptying the whole trash. Calls that read
the whole Disk log counts, never names. CONTRIBUTING explains how to
run it.
Checked