From 9af155d40accef7aac3ffc6eb960d197798ebd1f Mon Sep 17 00:00:00 2001
From: Christian Cleberg <hello@cleberg.net>
Date: Fri, 7 Aug 2026 18:47:01 -0500
Subject: fix: correct inverted media guard in sendMedia
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

sendMedia returned when the assembled URL was non-empty — i.e. for every
deviation that actually has media — so the random-media endpoint served
an empty body and never sent the image. For a media-less deviation it
instead fell through to mediaURL[21:] on an empty string, panicking in
proxy mode. Guard on len == 0 so real media is sent and absent media is
a no-op.
---
 app/api_test.go | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 app/api_test.go

(limited to 'app/api_test.go')

diff --git a/app/api_test.go b/app/api_test.go
new file mode 100644
index 0000000..9584e40
--- /dev/null
+++ b/app/api_test.go
@@ -0,0 +1,59 @@
+package app
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/krazywarez/devianter"
+)
+
+// fullviewDeviation returns a deviation whose media assembles into a non-empty
+// wixmp URL, i.e. one that sendMedia is meant to serve.
+func fullviewDeviation() *devianter.Deviation {
+	d := &devianter.Deviation{}
+	d.Media.BaseUri = "https://images-wixmp-abc.wixmp.com/f/u/x.png"
+	d.Media.Name = "x"
+	d.Media.Types = append(d.Media.Types, struct {
+		T    string
+		H, W int
+	}{T: "fullview", H: 1920, W: 1280})
+	return d
+}
+
+// TestSendMediaServesRealMedia is the regression test for the inverted guard: a
+// deviation that has media must be sent, not dropped. In non-proxy mode that is
+// a 302 to the wixmp URL; the pre-fix guard returned before writing anything.
+func TestSendMediaServesRealMedia(t *testing.T) {
+	proxy := CFG.Proxy
+	CFG.Proxy = false
+	defer func() { CFG.Proxy = proxy }()
+
+	w := httptest.NewRecorder()
+	API{main: &skunkyart{Writer: w}}.sendMedia(fullviewDeviation())
+
+	if w.Code != 302 {
+		t.Errorf("status is %d, want a 302 redirect to the media", w.Code)
+	}
+	if w.Header().Get("Location") == "" {
+		t.Error("no Location header set — the media was dropped")
+	}
+}
+
+// TestSendMediaIgnoresEmptyMedia pins the other half of the bug: a deviation
+// with no media must be a no-op. With proxy on, the pre-fix code fell through to
+// mediaURL[21:] on an empty string and panicked.
+func TestSendMediaIgnoresEmptyMedia(t *testing.T) {
+	proxy := CFG.Proxy
+	CFG.Proxy = true
+	defer func() { CFG.Proxy = proxy }()
+
+	w := httptest.NewRecorder()
+	API{main: &skunkyart{Writer: w}}.sendMedia(&devianter.Deviation{})
+
+	if w.Code != 200 {
+		t.Errorf("status is %d, want nothing written (recorder default 200)", w.Code)
+	}
+	if loc := w.Header().Get("Location"); loc != "" {
+		t.Errorf("Location %q set for a media-less deviation, want none", loc)
+	}
+}
-- 
cgit v1.2.3