@content
Feature: Card file attachments
  Files attached to cards are uploaded via a presigned PUT URL and accessed via
  a time-limited signed download URL.  Access without a valid signature must be
  rejected by the storage backend.

  Scenario: Upload and download a card attachment via signed URLs
    Given a card exists
    When I request an upload URL for filename "hello.txt" and content type "text/plain"
    And I PUT "Hello, Pikku!" to the upload URL
    Then the upload response status is 200 or 201
    When I request a signed download URL for filename "hello.txt"
    Then the signed URL response contains a signedUrl
    And downloading the signed URL returns "Hello, Pikku!"

  Scenario: Unsigned access to an uploaded file is rejected
    Given a card exists
    When I request an upload URL for filename "secret.txt" and content type "text/plain"
    And I PUT "Top secret" to the upload URL
    Then the upload response status is 200 or 201
    When I request a signed download URL for filename "secret.txt"
    And I strip the signature from the signed URL
    Then fetching the unsigned URL returns a 4xx status