fix: 修复文件预览重定向与扩展名解析

server/hdl_files_test.go

@@ -22,12 +22,15 @@ import (
 )
 
 type testLargeFileMediaHandler struct {
-	def  *types.FileDef
-	data string
+	def           *types.FileDef
+	data          string
+	fid           types.Uid
+	headersCalled bool
 }
 
 func (h *testLargeFileMediaHandler) Init(string) error { return nil }
 func (h *testLargeFileMediaHandler) Headers(types.TenantID, string, *url.URL, http.Header, bool) (http.Header, int, error) {
+	h.headersCalled = true
 	return nil, 0, nil
 }
 func (h *testLargeFileMediaHandler) Upload(def *types.FileDef, file io.Reader) (string, int64, error) {
@@ -43,7 +46,7 @@ func (h *testLargeFileMediaHandler) Download(types.TenantID, string) (*types.Fil
 }
 func (h *testLargeFileMediaHandler) Delete([]string) error { return nil }
 func (h *testLargeFileMediaHandler) GetIdFromUrl(string) types.Uid {
-	return types.ZeroUid
+	return h.fid
 }
 
 func TestAuthFileRequestFromSessionRequiresTenant(t *testing.T) {
@@ -144,6 +147,43 @@ func TestAuthorizeLargeFileDownloadRejectsCrossTenant(t *testing.T) {
 	}
 }
 
+func TestAuthorizeLargeFileRequestURLRequiresAccessBeforeRedirect(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	oldStore := store.Store
+	oldFiles := store.Files
+	defer func() {
+		store.Store = oldStore
+		store.Files = oldFiles
+	}()
+
+	fid := types.Uid(100)
+	handler := &testLargeFileMediaHandler{fid: fid}
+	mockStore := mock_store.NewMockPersistentStorageInterface(ctrl)
+	files := mock_store.NewMockFilePersistenceInterface(ctrl)
+	store.Store = mockStore
+	store.Files = files
+
+	fd := &types.FileDef{
+		ObjHeader: types.ObjHeader{Id: fid.String(), UpdatedAt: time.Date(2026, 8, 13, 9, 0, 0, 0, time.UTC)},
+		TenantID:  7,
+		Status:    types.UploadCompleted,
+		MimeType:  "image/jpeg",
+		Location:  "image.jpeg",
+	}
+	mockStore.EXPECT().GetMediaHandler().Return(handler)
+	files.EXPECT().Get(types.TenantID(7), fid.String()).Return(fd, nil)
+	files.EXPECT().UserHasAccess(types.TenantID(7), fid.String(), types.Uid(42)).Return(false, nil)
+
+	if err := authorizeLargeFileRequestURL(7, 42, "/v0/file/s/file.jpeg"); err != types.ErrPermissionDenied {
+		t.Fatalf("expected permission denied, got %v", err)
+	}
+	if handler.headersCalled {
+		t.Fatal("media headers should not be called by authorization helper")
+	}
+}
+
 func TestContentDispositionAttachmentSanitizesName(t *testing.T) {
 	fd := &types.FileDef{
 		ObjHeader: types.ObjHeader{Id: types.Uid(100).String()},