Close data leaks: remove anonymous user creation, hide private playlists, validate uploads and clamp gateway ranges

2026-09-24 05:00:21 +02:00
parent c8fe28b07b
commit c8e9c7790e
34 changed files with 374 additions and 553 deletions
@@ -35,6 +35,19 @@ public sealed class CreateTrackCommandHandlerTests : HandlerTestBase
        (TestEntities.UploadIntent(userId, UploadIntentPurpose.TrackPicture, objectName: "cover.webp"),
         TestEntities.UploadIntent(userId, UploadIntentPurpose.TrackAudio, objectName: "song.mp3"));

+    [Fact]
+    public async Task Handle_SameIntentForPictureAndAudio_ReturnsValidationError()
+    {
+        var user = TestEntities.User();
+        var (picture, audio) = SeedIntents(user.Id);
+        await SeedAsync(user, picture, audio);
+
+        var command = new CreateTrackCommand(user.Id, "My Song", picture.Id, picture.Id, [Genre.Pop]);
+        var result = await CreateHandler().Handle(command, TestContext.Current.CancellationToken);
+
+        Assert.Equal(ErrorType.Validation, result.FirstError.Type);
+    }
+
    [Fact]
    public async Task Handle_ValidIntents_CreatesTrackAndPublishesEvent()
    {