RenewCMS/features/remove_legacy_article_image_alias.qa.md

QA procedure: remove_legacy_article_image_alias

Superseded in part by roles_permissions_content_scope: the article routes are gated by the content.* permissions of the caller's role (content.create, content.update, content.delete and content.publish; a refusal is 403 "missing_permission" with the header X-Missing-Permission), and content.read decides which drafts show: every draft at all, only the caller's own drafts at own, none otherwise. A draft the caller may not read answers 404 "Article not found", and a role that cannot be resolved is treated as holding no permission.

Package: test (black-box, httptest, in-memory fakes, no live server).

Setup

1. Call validator.InitValidator().
2. Build the article router exactly as NewArticleRouter does after the change (no image handler), wrapped in Verifier, Authenticator, RequireCurrentToken and RequireVerifiedUser, over fake article, image and user repositories. Reuse newMultipartFileRequest and pngBytes from test/media_fixtures_test.go.

HTTP checks

3. POST /v1/article/1/image with a valid PNG and a valid cookie -> 404, Create never called.
4. DELETE /v1/article/1/image/10 with a valid cookie -> 404, image 10 still exists.
5. POST /v1/media/ with a valid PNG -> 201 with id and url (this stays covered by media_library_http_test.go; confirm the case still passes after the deletions).
6. PATCH /v1/article/1/publish still answers as in verified_account_required_http_test.go.

Cleanup (Go)

7. Delete test/upload_article_image_http_test.go.
8. In test/verified_account_required_http_test.go: remove the api/handlers/image import, the imageHandler construction (line 34), the route r.Post("/{id}/image", ...) (line 53) and the "unverified user is refused when attaching an image" case (around line 149).
9. Run task test and task lint; nothing else may reference PostLegacyArticleImage or handlers/image.

Manual verification

With task dev, curl -i -X POST /v1/article/1/image with a valid cookie answers 404.