fix: group moderation and profile sync

server/hdl_files_test.go

@@ -6,6 +6,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"strings"
 	"testing"
 	"time"
 
@@ -23,11 +24,16 @@ type testLargeFileMediaHandler struct {
 	data          string
 	fid           types.Uid
 	headersCalled bool
+	corsOrigins   []media.AllowedOrigin
 }
 
 func (h *testLargeFileMediaHandler) Init(string) error { return nil }
-func (h *testLargeFileMediaHandler) Headers(types.TenantID, string, *url.URL, http.Header, bool) (http.Header, int, error) {
+func (h *testLargeFileMediaHandler) Headers(_ types.TenantID, method string, _ *url.URL, headers http.Header, serve bool) (http.Header, int, error) {
 	h.headersCalled = true
+	if h.corsOrigins != nil {
+		response, status := media.CORSHandler(method, headers, h.corsOrigins, serve)
+		return response, status, nil
+	}
 	return nil, 0, nil
 }
 func (h *testLargeFileMediaHandler) Upload(def *types.FileDef, file io.Reader) (string, int64, error) {
@@ -46,6 +52,42 @@ func (h *testLargeFileMediaHandler) GetIdFromUrl(string) types.Uid {
 	return h.fid
 }
 
+func TestLargeFileUploadPreflightAllowsPost(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	oldStore := store.Store
+	defer func() { store.Store = oldStore }()
+
+	origins, err := media.ParseCORSAllow([]string{"https://web1.118im.com"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	handler := &testLargeFileMediaHandler{corsOrigins: origins}
+	mockStore := mock_store.NewMockPersistentStorageInterface(ctrl)
+	mockStore.EXPECT().GetMediaHandler().Return(handler)
+	store.Store = mockStore
+
+	req := httptest.NewRequest(http.MethodOptions, "/v0/file/u/", nil)
+	req.Header.Set("Origin", "https://web1.118im.com")
+	req.Header.Set("Access-Control-Request-Method", http.MethodPost)
+	req.Header.Set("Access-Control-Request-Headers", "authorization,x-meetingim-apikey")
+	wrt := httptest.NewRecorder()
+	largeFileReceiveHTTP(wrt, req)
+
+	if wrt.Code != http.StatusNoContent || !handler.headersCalled {
+		t.Fatalf("preflight response: status=%d headers_called=%t", wrt.Code, handler.headersCalled)
+	}
+	if got := wrt.Header().Get("Access-Control-Allow-Origin"); got != "https://web1.118im.com" {
+		t.Fatalf("allowed origin = %q", got)
+	}
+	if got := wrt.Header().Get("Access-Control-Allow-Methods"); !strings.Contains(got, http.MethodPost) {
+		t.Fatalf("POST missing from allowed methods: %q", got)
+	}
+	if got := wrt.Header().Get("Access-Control-Allow-Headers"); got != "authorization,x-meetingim-apikey" {
+		t.Fatalf("requested headers not allowed explicitly: %q", got)
+	}
+}
+
 func TestAuthFileRequestFromSessionRequiresTenant(t *testing.T) {
 	oldSessionStore := globals.sessionStore
 	globals.sessionStore = NewSessionStore(time.Minute)