# QA procedure: serve_uploaded_images

Package: `test` (black-box, new file `test/serve_uploaded_images_test.go`).

## Setup shared by every case
1. Call `validator.InitValidator()` once (harmless even though this handler
   does no validation).
2. Create a fresh `uploadDir := t.TempDir()` per test/subtest. This handler
   has no domain repository to fake — it serves real files from a real
   directory on disk, which is standard for filesystem-serving code and is
   not the "real SQLite file" / "live server" / "real SMTP" the project
   convention rules out.
3. Build `staticimages.NewHandler(uploadDir)` (`api/handlers/staticimages`).
4. Mount it on a fresh `chi.NewRouter()` mirroring `api/router.go`'s shape
   after this slice:
   - `r.Mount("/static/uploadedImages", staticHandler)` — no
     `jwtauth.Verifier` / `jwtauth.Authenticator` wrapping.
   - `r.Mount("/", stubFrontend)` where `stubFrontend` is a trivial
     `http.HandlerFunc` that writes a recognizable marker string, e.g.
     `"SPA-INDEX-MARKER"`, with status 200 — standing in for the real SPA
     fallback, just to prove routing order without needing the embedded
     `dist/` build.
5. Helper to seed a file: `os.WriteFile(filepath.Join(uploadDir, name),
   content, 0o644)`, creating parent directories with `os.MkdirAll` when a
   subdirectory case needs one.

## HTTP checks
6. Write `4b9e2f1a-1111-....png`, `.jpeg`, `.webp` files with distinct
   non-empty byte content. For each, `httptest.NewRequest("GET",
   "/static/uploadedImages/"+name, nil)`, no cookie. Assert status `200`;
   `Content-Type` equals the expected value; `Cache-Control` equals
   `"public, no-cache"`; `X-Content-Type-Options` equals
   `"nosniff"`; `Content-Security-Policy` header is absent; body bytes equal
   what was written.
7. Write a `.svg` file whose content contains an inline `onload` handler
   (content doesn't matter functionally, just needs to be non-empty and
   distinguishable). GET it. Assert status `200`, `Content-Type` is
   `"image/svg+xml"`, `Content-Security-Policy` equals `"default-src
   'none'; style-src 'unsafe-inline'; sandbox"`, `X-Content-Type-Options` is
   `"nosniff"`, body equals the exact SVG bytes (not sanitized/altered).
8. Write `notes.txt`. GET it. Assert status `200`, `Content-Type` is
   `"application/octet-stream"`, no `Content-Security-Policy` header.
9. Don't create `missing.png`. GET `/static/uploadedImages/missing.png`.
   Assert status `404`; assert the body does **not** contain
   `"SPA-INDEX-MARKER"` (proves the static mount, not the frontend
   fallback, produced the 404 — i.e. mount ordering in the test router
   matches the required ordering in `api/router.go`).
10. Write a file, then `os.Remove` it before the request. GET its old name.
    Assert status `404`.
11. `os.MkdirAll(filepath.Join(uploadDir, "nested"), 0o755)` and write a
    file inside it. GET `/static/uploadedImages/nested`. Assert status
    `404` (a directory is never listed or served).
12. Write one real file inside `uploadDir`, and separately write a marker
    file (e.g. `"sentinel-outside"`) to a location outside `uploadDir` (a
    second `t.TempDir()`, or a path one level above `uploadDir`) so a
    successful escape would be detectable. For each of the traversal paths
    `"../"+sentinelName`, `"..%2f"+sentinelName` (raw in the request path,
    since `httptest.NewRequest` takes a literal target string and Go's
    `net/http` mux/handler must not decode-then-escape), and a
    triple-`..%2f` variant: send `GET /static/uploadedImages/<path>`.
    Assert status `404` for every case, and assert the response body never
    equals the sentinel file's content.
13. Write a `.webp` file. Send `httptest.NewRequest("HEAD", ...)`. Assert
    status `200`, the same `Content-Type` / `Cache-Control` /
    `X-Content-Type-Options` headers as the GET case, and an empty response
    body (`rec.Body.Len() == 0`).
14. Repeat step 6's PNG case with explicitly no `Cookie` header set on the
    request (already true in step 6, but assert this once more as its own
    subtest/comment-free assertion block) and confirm status `200`, not a
    3xx redirect and not `401`.

## Manual verification (not exercised by the Go test)
- Real end-to-end mount order: run `task dev` or a built `task build`
  binary, confirm `GET /static/uploadedImages/<unknown>` returns 404 from
  the real router (with the real embedded `dist/`), not `index.html`, since
  the Go test above stands in a stub for the frontend rather than the
  embedded SPA.
- Browser-level CSP enforcement: open an uploaded SVG containing a script
  directly in a browser and confirm the CSP header actually blocks
  execution (header presence is asserted by the test; browser enforcement
  isn't).
- No SMTP involvement.