answer 404 for a static path the root refuses

Found by /invariants: a symlink under static/ pointing outside the site root answered 500. The guard held — os.Root refused it and no bytes escaped — but the response confirmed the path was there, where every other miss answers 404. Same reasoning as a hidden bundle answering 404 rather than 403 (ADR-0024). serveStatic now stats through the rooted FS first, so a directory, a missing file, and a refused name are one answer. That also folds the old noListing and staticFS into one function, since "cannot serve this" was already their shared job. The test uses a real temp directory rather than a MapFS, because the guard under test belongs to os.Root; verified it fails with 500 against the previous code before keeping it. Splitting web_test.go at the seam the package already had — resolve_test.go for what a path means, web_test.go for what happens once it resolves — because it crossed FILE_LOC_WARN. Same response as content.go at entry 9.
2026-08-01 02:23:35 +06:00
parent 7117d70b45
commit d80885a412
4 changed files with 148 additions and 96 deletions
@@ -0,0 +1,89 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// These cover what a path *means*: which spelling is canonical and which redirects to it. What happens
+// once a path resolves is web_test.go's business.
+
+func TestSlashlessPathRedirectsPermanently(t *testing.T) {
+	h := testHandler(t)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/pages/about", nil))
+	if rec.Code != http.StatusMovedPermanently {
+		t.Fatalf("got %d, want 301", rec.Code)
+	}
+	if loc := rec.Header().Get("Location"); loc != "/pages/about/" {
+		t.Errorf("Location = %q", loc)
+	}
+}
+
+func TestDefaultLanguagePrefixRedirectsToRoot(t *testing.T) {
+	h := multilingualHandler(t)
+	for path, want := range map[string]string{
+		"/en/pages/about/": "/pages/about/",
+		"/en/pages/about":  "/pages/about/",
+	} {
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, path, nil))
+		if rec.Code != http.StatusMovedPermanently {
+			t.Errorf("GET %s = %d, want 301: /en/… must never be live (ADR-0009)", path, rec.Code)
+			continue
+		}
+		if loc := rec.Header().Get("Location"); loc != want {
+			t.Errorf("GET %s → %q, want %q", path, loc, want)
+		}
+	}
+}
+
+func TestPrefixedSlashlessPathRedirectsWithItsPrefix(t *testing.T) {
+	h := multilingualHandler(t)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/bn/pages/about", nil))
+	if rec.Code != http.StatusMovedPermanently {
+		t.Fatalf("got %d, want 301", rec.Code)
+	}
+	if loc := rec.Header().Get("Location"); loc != "/bn/pages/about/" {
+		t.Errorf("Location = %q, want /bn/pages/about/", loc)
+	}
+}
+
+func TestUnknownLanguagePrefixIsNotALanguage(t *testing.T) {
+	h := multilingualHandler(t)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/fr/pages/about/", nil))
+	if rec.Code != http.StatusNotFound {
+		t.Errorf("got %d, want 404: fr is not a language this site has", rec.Code)
+	}
+}
+
+func TestPageOneIsNeverItsOwnURL(t *testing.T) {
+	h := listingHandler(t, 3)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/posts/page/1/", nil))
+	if rec.Code != http.StatusMovedPermanently {
+		t.Fatalf("got %d, want 301 (ADR-0028)", rec.Code)
+	}
+	if loc := rec.Header().Get("Location"); loc != "/posts/" {
+		t.Errorf("Location = %q, want /posts/", loc)
+	}
+}
+
+func TestTagPathsCanonicaliseAndMiss(t *testing.T) {
+	h := tagHandler(t)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/tags/monsoon", nil))
+	if rec.Code != http.StatusMovedPermanently || rec.Header().Get("Location") != "/tags/monsoon/" {
+		t.Errorf("slashless tag path = %d %q", rec.Code, rec.Header().Get("Location"))
+	}
+	for _, path := range []string{"/tags/nothing/", "/tags/", "/posts/tags/nothing/"} {
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, path, nil))
+		if rec.Code != http.StatusNotFound {
+			t.Errorf("GET %s = %d, want 404", path, rec.Code)
+		}
+	}
+}