24 lines
1.1 KiB
Gherkin
24 lines
1.1 KiB
Gherkin
@content
|
|
Feature: Card file attachments
|
|
Files attached to cards are uploaded via a presigned PUT URL and accessed via
|
|
a time-limited signed download URL. Access without a valid signature must be
|
|
rejected by the storage backend.
|
|
|
|
Scenario: Upload and download a card attachment via signed URLs
|
|
Given a card exists
|
|
When I request an upload URL for filename "hello.txt" and content type "text/plain"
|
|
And I PUT "Hello, Pikku!" to the upload URL
|
|
Then the upload response status is 200 or 201
|
|
When I request a signed download URL for filename "hello.txt"
|
|
Then the signed URL response contains a signedUrl
|
|
And downloading the signed URL returns "Hello, Pikku!"
|
|
|
|
Scenario: Unsigned access to an uploaded file is rejected
|
|
Given a card exists
|
|
When I request an upload URL for filename "secret.txt" and content type "text/plain"
|
|
And I PUT "Top secret" to the upload URL
|
|
Then the upload response status is 200 or 201
|
|
When I request a signed download URL for filename "secret.txt"
|
|
And I strip the signature from the signed URL
|
|
Then fetching the unsigned URL returns a 4xx status
|