24 lines
2.0 KiB
Markdown
24 lines
2.0 KiB
Markdown
# QA procedure: remove_legacy_article_image_alias
|
|
|
|
> Superseded in part by roles_permissions_content_scope: the article routes are gated by the content.* permissions of the caller's role (content.create, content.update, content.delete and content.publish; a refusal is 403 "missing_permission" with the header X-Missing-Permission), and content.read decides which drafts show: every draft at all, only the caller's own drafts at own, none otherwise. A draft the caller may not read answers 404 "Article not found", and a role that cannot be resolved is treated as holding no permission.
|
|
|
|
Package: `test` (black-box, httptest, in-memory fakes, no live server).
|
|
|
|
## Setup
|
|
1. Call `validator.InitValidator()`.
|
|
2. Build the article router exactly as `NewArticleRouter` does after the change (no image handler), wrapped in `Verifier`, `Authenticator`, `RequireCurrentToken` and `RequireVerifiedUser`, over fake article, image and user repositories. Reuse `newMultipartFileRequest` and `pngBytes` from `test/media_fixtures_test.go`.
|
|
|
|
## HTTP checks
|
|
3. `POST /v1/article/1/image` with a valid PNG and a valid cookie -> 404, `Create` never called.
|
|
4. `DELETE /v1/article/1/image/10` with a valid cookie -> 404, image 10 still exists.
|
|
5. `POST /v1/media/` with a valid PNG -> 201 with `id` and `url` (this stays covered by `media_library_http_test.go`; confirm the case still passes after the deletions).
|
|
6. `PATCH /v1/article/1/publish` still answers as in `verified_account_required_http_test.go`.
|
|
|
|
## Cleanup (Go)
|
|
7. Delete `test/upload_article_image_http_test.go`.
|
|
8. In `test/verified_account_required_http_test.go`: remove the `api/handlers/image` import, the `imageHandler` construction (line 34), the route `r.Post("/{id}/image", ...)` (line 53) and the "unverified user is refused when attaching an image" case (around line 149).
|
|
9. Run `task test` and `task lint`; nothing else may reference `PostLegacyArticleImage` or `handlers/image`.
|
|
|
|
## Manual verification
|
|
With `task dev`, `curl -i -X POST /v1/article/1/image` with a valid cookie answers 404.
|