v0.332.0: one sign-in for the file manager — a dashboard pass, a host-only files cookie, a per-box secret header (R-1100, operator D16)

2026-10-19 04:56:56 +02:00
parent ba4a6f060b
commit 9bdd8f8fe8
21 changed files with 1078 additions and 54 deletions
@@ -82,6 +82,11 @@ func TestImportFolderLink_IsCanonical(t *testing.T) {
 	a := importFolderLink("demo-felhom.eu", "paperless")
 	b := importFolderLink("demo-felhom.eu", "calibre")
 	for _, l := range []string{a, b} {
+		u, err := url.Parse(l) // R-1100: through the dashboard's pass; the FileBrowser path rides `to`
+		if err != nil || u.Host != "felhom.demo-felhom.eu" || u.Path != filesOpenPath {
+			t.Fatalf("import link does not go through the dashboard's pass: %q", l)
+		}
+		l = u.Query().Get("to")
 		if !strings.Contains(l, "/files/"+url.PathEscape(infra.FileBrowserImportLabel)+"/") {
 			t.Errorf("import link must go through the canonical source: %q", l)
 		}