|
LLM e2e scenarios (S19-S25):
S19 — permissions matrix (viewer vs owner across two sets). Flags a
design mismatch: viewer role currently permits tags/favorites/
notes via verifyAccess instead of verifyModifyAccess, contrary
to the model.RoleViewer doc comment. Not fixed; documented.
S20 — HTTP Range and HEAD on /stream, /download, /thumbnail. Flags
no-ETag (cacheability gap) and locks in stdlib Range semantics
(single, suffix, open, 416, multi-range).
S21 — upload negatives (missing parts, bad extension, traversal,
404, 403, dedup collisions, 413 skip note).
S22 — share expiry (sqlite UPDATE on expires_at, then verify 410 on
all three /s/{token}/... routes) + 5-token uniqueness via
crypto/rand audit.
S23 — user deletion cascade with schema audit: every user FK has
ON DELETE CASCADE; tags are global by design.
S24 — soft-delete persistence across rescan. Surfaces TWO real bugs
in scanner: (1) re-INSERT of soft-deleted media hits UNIQUE
constraint and fails the scan; (2) files deleted from disk
leave orphan media rows that never get reconciled.
S25 — SQL injection + XSS + path-traversal probes. SQL surface
fully parameterised (audited repository/media.go); XSS storage
is API-correct (UI escapes); share path traversal blocked by
Go ServeMux path cleaning.
Playwright e2e-web extensions (Round 7, 10 new tests):
share-page.test.ts (4) — share metadata payload, audio/video stage
elements, invalid-token 404 page.
search-filter.test.ts (3) — search filter, like:1 favourites syntax,
clearing input restores full grid.
admin-panel.test.ts (3) — user list, permissions section, rescan
button + scan-progress UI.
Round 8 audit (Android): 24/24 Flutter widget tests pass; the app is
currently a stub with UnimplementedError-only API client, so no
additional test scaffolding is justified until production code lands.
Verified: 25/25 LLM scenarios pass; 22/22 Playwright tests pass; full
Go unit-test suite green.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
|
Add player-server/testdata/media/ with ten public-domain media files:
five LibriVox Aesop's-Fables mp3 chapters (audiobooks/), four NASA
image-library jpgs (images/), and one NASA mp4 short (videos/). Total
~11 MB; each file's source URL and license is documented in
testdata/LICENSES.md and README.md.
Switch every default reference in tests, scenarios, docs, and CI from
MEDIA_ROOT=./testmedia to MEDIA_ROOT=./testdata/media so a fresh clone
can run mage E2E and the Playwright smoke suite without supplying any
external media. The ./testmedia path remains gitignored — it's the
local-only personal library directory.
Verified: 12/12 Playwright e2e-web pass; 18/18 LLM e2e scenarios pass
against the new fixture set.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
