fix(web): make closed cases fully viewable (discovery-gate, not access-gate)
Follow-up to 6d1ca71: that commit made the recordings sub-page render for a
closed case by threading ?show_closed=1, but the page's own links and the
audio player still 404'd — playback was dead and the back link led nowhere.
Root cause: the `.closed` marker was implemented as an ACCESS gate (every
case-scoped read 404s a closed case unless the opt-in flag is threaded
through), while it is documented as a DISCOVERY gate ("hidden from the
default listing"). Threading the flag through every link/redirect is
whack-a-mole; the next new link forgets it.
Resolved in favour of discovery-gate semantics: the `.closed` marker only
filters the default case LIST (scan_user_cases). Direct/deep-link access to
a known, owned case and all its sub-resources is closed-agnostic. IDOR is
unchanged — it comes from the per-user root + existence check, orthogonal
to closed-ness.
Scope 1 — closed cases are fully viewable:
- handle_audio: drop the is_closed -> 404 gate (web.rs). Audio is a
capability URL behind the same per-user path + slug/UUID/filename
validation as an open case.
- handle_case_page / handle_case_recordings: always resolve via
locate_closed_case_or_404; show_closed is no longer an access gate, so
back links (recordings -> case, case -> list) reach live pages without
threading the flag.
- the "back to list" links carry ?show_closed=1 when the case is closed
(computed server-side from the marker) so the user returns to the
closed-inclusive list, not the default list that hides the case.
Scope 2 — closed means read-only:
- case_page.html withholds the analyze / reset / re-analyze / retry forms
on closed cases; only the reopen affordance remains.
- case_recordings.html withholds the per-recording delete form on closed
cases (CaseRecordingsTemplate gains is_closed).
- the mutating handlers (analyze/reset/delete/oneliner) keep rejecting
closed cases via locate_case_or_404 as defense-in-depth behind the
now-hidden buttons.
Tests (RED-first):
- web_test: audio serves a closed case's file (200, not 404).
- case_page_test: closed case page + recordings render without
?show_closed=1; closed case hides analyze/reset; open case still shows
delete; closed case hides delete.
- analyze_test: closed_case_returns_404_on_detail rewritten to
closed_case_detail_renders_read_only — the old test pinned the
now-superseded access-gate contract.
cargo test (440 passed), clippy, and fmt all clean.
closes #17
This commit is contained in:
@@ -417,6 +417,180 @@ async fn case_recordings_back_link_targets_case_page() {
|
||||
);
|
||||
}
|
||||
|
||||
/// Property: a closed case is reachable by direct navigation WITHOUT
|
||||
/// `?show_closed=1`. The `.closed` marker is a discovery filter for the case
|
||||
/// list, not an access gate — so deep-linking to a closed case, or following
|
||||
/// the recordings page's back link (which carries no flag), must render the
|
||||
/// case page, not 404. Regression for issue #17.
|
||||
#[tokio::test]
|
||||
async fn case_page_renders_for_closed_case_without_show_closed() {
|
||||
let cfg = TestConfig::new()
|
||||
.with_label("cp-closed-noflag")
|
||||
.with_user(test_user("dr_a"))
|
||||
.with_llm("http://unused")
|
||||
.build();
|
||||
let case_id = "11111111-1111-1111-1111-111111111111";
|
||||
let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
|
||||
seed_recording(&case_dir, "2026-04-15T10-00-00Z", Some("ein Text"));
|
||||
write_closed_marker(&case_dir, "2026-04-15T12:00:00Z");
|
||||
|
||||
let app = doctate_server::create_router(cfg);
|
||||
let cookie = login_dr_a(&app).await;
|
||||
|
||||
// No ?show_closed=1 on the URL — the deep-link / back-link path.
|
||||
let resp = app
|
||||
.oneshot(get_with_cookie(paths::case_detail(case_id), &cookie))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
resp.status(),
|
||||
StatusCode::OK,
|
||||
"closed case page must render on direct access, not 404",
|
||||
);
|
||||
let body = body_string(resp).await;
|
||||
assert!(
|
||||
body.contains(&format!(r#"action="{}""#, paths::case_reopen(case_id))),
|
||||
"closed case page must show the reopen action (proves the closed view rendered)"
|
||||
);
|
||||
}
|
||||
|
||||
/// Property: a closed case is read-only. Closing means "done", so the
|
||||
/// mutating affordances (analyze, reset) are withheld even though the case
|
||||
/// page still renders for viewing. Only reopen stays — it's how the closed
|
||||
/// state is left.
|
||||
#[tokio::test]
|
||||
async fn case_page_hides_mutation_actions_when_closed() {
|
||||
let cfg = TestConfig::new()
|
||||
.with_label("cp-closed-ro")
|
||||
.with_user(test_admin("dr_a"))
|
||||
.with_llm("http://unused")
|
||||
.build();
|
||||
let case_id = "11111111-1111-1111-1111-111111111111";
|
||||
let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
|
||||
seed_recording(&case_dir, "2026-04-15T10-00-00Z", Some("ein Text"));
|
||||
write_closed_marker(&case_dir, "2026-04-15T12:00:00Z");
|
||||
|
||||
let app = doctate_server::create_router(cfg);
|
||||
let cookie = login_dr_a(&app).await;
|
||||
|
||||
let resp = app
|
||||
.oneshot(get_with_cookie(paths::case_detail(case_id), &cookie))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), StatusCode::OK);
|
||||
let body = body_string(resp).await;
|
||||
|
||||
assert!(
|
||||
!body.contains(&format!(r#"action="{}""#, paths::case_analyze(case_id))),
|
||||
"closed case must not expose the analyze action"
|
||||
);
|
||||
assert!(
|
||||
!body.contains(&format!(r#"action="{}""#, paths::case_reset(case_id))),
|
||||
"closed case must not expose the reset action"
|
||||
);
|
||||
assert!(
|
||||
body.contains(&format!(r#"action="{}""#, paths::case_reopen(case_id))),
|
||||
"closed case must still offer reopen"
|
||||
);
|
||||
}
|
||||
|
||||
/// Property: the recordings sub-page is reachable for a closed case WITHOUT
|
||||
/// `?show_closed=1` (same discovery-gate reasoning as the case page).
|
||||
#[tokio::test]
|
||||
async fn case_recordings_renders_for_closed_case_without_show_closed() {
|
||||
let cfg = TestConfig::new()
|
||||
.with_label("rec-closed-noflag")
|
||||
.with_user(test_user("dr_a"))
|
||||
.with_llm("http://unused")
|
||||
.build();
|
||||
let case_id = "11111111-1111-1111-1111-111111111111";
|
||||
let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
|
||||
seed_recording(&case_dir, "2026-04-15T10-00-00Z", Some("erste Aufnahme"));
|
||||
write_closed_marker(&case_dir, "2026-04-15T12:00:00Z");
|
||||
|
||||
let app = doctate_server::create_router(cfg);
|
||||
let cookie = login_dr_a(&app).await;
|
||||
|
||||
let resp = app
|
||||
.oneshot(get_with_cookie(paths::case_recordings(case_id), &cookie))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
resp.status(),
|
||||
StatusCode::OK,
|
||||
"closed case recordings must render on direct access, not 404",
|
||||
);
|
||||
let body = body_string(resp).await;
|
||||
assert!(
|
||||
body.contains("2026-04-15T10-00-00Z.m4a"),
|
||||
"recording on disk must be listed for the closed case"
|
||||
);
|
||||
}
|
||||
|
||||
/// Property: an OPEN case's recordings page exposes the per-recording delete
|
||||
/// form. Locks the positive side so the closed-case hiding below cannot
|
||||
/// silently regress into hiding delete everywhere.
|
||||
#[tokio::test]
|
||||
async fn case_recordings_shows_delete_when_open() {
|
||||
let cfg = TestConfig::new()
|
||||
.with_label("rec-del-open")
|
||||
.with_user(test_user("dr_a"))
|
||||
.with_llm("http://unused")
|
||||
.build();
|
||||
let case_id = "11111111-1111-1111-1111-111111111111";
|
||||
let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
|
||||
seed_recording(&case_dir, "2026-04-15T10-00-00Z", Some("Text"));
|
||||
|
||||
let app = doctate_server::create_router(cfg);
|
||||
let cookie = login_dr_a(&app).await;
|
||||
|
||||
let resp = app
|
||||
.oneshot(get_with_cookie(paths::case_recordings(case_id), &cookie))
|
||||
.await
|
||||
.unwrap();
|
||||
let body = body_string(resp).await;
|
||||
assert!(
|
||||
body.contains(&format!(
|
||||
r#"action="{}/delete""#,
|
||||
paths::case_recordings(case_id)
|
||||
)),
|
||||
"open recordings page must expose the delete action"
|
||||
);
|
||||
}
|
||||
|
||||
/// Property: a closed case is read-only — the per-recording delete form is
|
||||
/// withheld on the recordings sub-page, mirroring the case page hiding its
|
||||
/// mutating actions.
|
||||
#[tokio::test]
|
||||
async fn case_recordings_hides_delete_when_closed() {
|
||||
let cfg = TestConfig::new()
|
||||
.with_label("rec-del-closed")
|
||||
.with_user(test_user("dr_a"))
|
||||
.with_llm("http://unused")
|
||||
.build();
|
||||
let case_id = "11111111-1111-1111-1111-111111111111";
|
||||
let case_dir = seed_case(&cfg.data_path, "dr_a", case_id);
|
||||
seed_recording(&case_dir, "2026-04-15T10-00-00Z", Some("Text"));
|
||||
write_closed_marker(&case_dir, "2026-04-15T12:00:00Z");
|
||||
|
||||
let app = doctate_server::create_router(cfg);
|
||||
let cookie = login_dr_a(&app).await;
|
||||
|
||||
let resp = app
|
||||
.oneshot(get_with_cookie(paths::case_recordings(case_id), &cookie))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), StatusCode::OK);
|
||||
let body = body_string(resp).await;
|
||||
assert!(
|
||||
!body.contains(&format!(
|
||||
r#"action="{}/delete""#,
|
||||
paths::case_recordings(case_id)
|
||||
)),
|
||||
"closed recordings page must not expose the delete action"
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn case_page_uses_oneliner_as_h1_when_present() {
|
||||
let cfg = TestConfig::new()
|
||||
|
||||
Reference in New Issue
Block a user