From 22b155e8d09407d72cce7ab5b2d3a33fa8935545 Mon Sep 17 00:00:00 2001 From: happy5318 Date: Sun, 2 Aug 2026 18:10:18 +0800 Subject: [PATCH] test: strengthen HTML preview cache regression coverage Per review feedback: - Frontend: assert exact fetch(mediaUrl, {cache:'no-store'}) in loadHtmlInline body, not just 'fetch(mediaUrl' prefix (too broad, other fetch calls match the prefix) - Backend: assert Cache-Control: no-store on both attachment and inline HTML responses in test_html_media_endpoint_inline_requires_csp_sandbox - Both assertions fail independently if either the frontend no-store option or backend no-store policy is reverted --- tests/test_media_inline.py | 11 +++++++++++ tests/test_pdf_html_preview.py | 5 ++++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/tests/test_media_inline.py b/tests/test_media_inline.py index 64f97cfc..cc087443 100644 --- a/tests/test_media_inline.py +++ b/tests/test_media_inline.py @@ -849,6 +849,12 @@ class TestMediaEndpointIntegration(unittest.TestCase): any("sandbox allow-scripts" == h for h in headers.get_all("Content-Security-Policy", [])) ) self.assertEqual(body, html_bytes) + # HTML responses must use no-store to prevent stale preview on + # re-send of the same MEDIA: link (attachment branch). + self.assertEqual( + headers.get("Cache-Control"), "no-store", + "HTML attachment must use Cache-Control: no-store" + ) body, status, headers = self._get(f"/api/media?path={encoded}&inline=1") self.assertEqual(status, 200) @@ -859,6 +865,11 @@ class TestMediaEndpointIntegration(unittest.TestCase): any("sandbox allow-scripts" == h for h in headers.get_all("Content-Security-Policy", [])) ) self.assertEqual(body, html_bytes) + # Inline HTML preview must also use no-store (inline branch). + self.assertEqual( + headers.get("Cache-Control"), "no-store", + "Inline HTML preview must use Cache-Control: no-store" + ) finally: pathlib.Path(tmp_path).unlink(missing_ok=True) diff --git a/tests/test_pdf_html_preview.py b/tests/test_pdf_html_preview.py index 57fe4119..53f0cfcd 100644 --- a/tests/test_pdf_html_preview.py +++ b/tests/test_pdf_html_preview.py @@ -197,7 +197,10 @@ class TestLoadHtmlInlineFunction: body = ui[idx:idx + 1200] assert 'const mediaSessionId=' in body assert "'&session_id='+encodeURIComponent(mediaSessionId)" in body - assert 'fetch(mediaUrl' in body + assert "fetch(mediaUrl, {cache:'no-store'})" in body, ( + "loadHtmlInline must fetch with cache:'no-store' to bypass " + "browser cache for stale HTML preview (got body without no-store)" + ) assert "const publicMediaUrl='api/media?path='+encodeURIComponent(path);" in body assert "const openUrl=publicMediaUrl+'&inline=1';" in body