"""
Tests for media upload functionality (v1.2.0 Phase 3)
Tests media upload, validation, optimization, and display per ADR-057 and ADR-058.
Uses generated test images (PIL Image.new()) per Q31.
"""
import pytest
from PIL import Image
import io
from pathlib import Path
from starpunk.media import (
validate_image,
optimize_image,
save_media,
attach_media_to_note,
get_note_media,
delete_media,
MAX_FILE_SIZE,
MAX_DIMENSION,
RESIZE_DIMENSION,
MAX_IMAGES_PER_NOTE,
HEIC_SUPPORTED,
)
def create_test_image(width=800, height=600, format='PNG'):
"""
Generate test image using PIL
Per Q31: Use generated test images, not real files
Args:
width: Image width in pixels
height: Image height in pixels
format: Image format (PNG, JPEG, GIF, WEBP)
Returns:
Bytes of image data
"""
img = Image.new('RGB', (width, height), color='red')
buffer = io.BytesIO()
img.save(buffer, format=format)
buffer.seek(0)
return buffer.getvalue()
def create_test_heic(width=800, height=600):
"""
Generate test HEIC image using pillow-heif
Args:
width: Image width in pixels
height: Image height in pixels
Returns:
Bytes of HEIC image data
"""
if not HEIC_SUPPORTED:
pytest.skip("pillow-heif not available")
import pillow_heif
# Create a simple RGB image
img = Image.new('RGB', (width, height), color='blue')
# Convert to HEIC
buffer = io.BytesIO()
heif_file = pillow_heif.from_pillow(img)
heif_file.save(buffer, format='HEIF')
buffer.seek(0)
return buffer.getvalue()
class TestImageValidation:
"""Test validate_image function"""
def test_valid_jpeg(self):
"""Test validation of valid JPEG image"""
image_data = create_test_image(800, 600, 'JPEG')
file_data, mime_type, width, height = validate_image(image_data, 'test.jpg')
assert mime_type == 'image/jpeg'
assert width == 800
assert height == 600
assert file_data == image_data # No conversion
def test_valid_png(self):
"""Test validation of valid PNG image"""
image_data = create_test_image(800, 600, 'PNG')
file_data, mime_type, width, height = validate_image(image_data, 'test.png')
assert mime_type == 'image/png'
assert width == 800
assert height == 600
assert file_data == image_data # No conversion
def test_valid_gif(self):
"""Test validation of valid GIF image"""
image_data = create_test_image(800, 600, 'GIF')
file_data, mime_type, width, height = validate_image(image_data, 'test.gif')
assert mime_type == 'image/gif'
assert width == 800
assert height == 600
assert file_data == image_data # No conversion
def test_valid_webp(self):
"""Test validation of valid WebP image"""
image_data = create_test_image(800, 600, 'WEBP')
file_data, mime_type, width, height = validate_image(image_data, 'test.webp')
assert mime_type == 'image/webp'
assert width == 800
assert height == 600
assert file_data == image_data # No conversion
def test_file_too_large(self):
"""Test rejection of >10MB file (per Q6)"""
# Create data larger than MAX_FILE_SIZE
large_data = b'x' * (MAX_FILE_SIZE + 1)
with pytest.raises(ValueError) as exc_info:
validate_image(large_data, 'large.jpg')
assert "File too large" in str(exc_info.value)
def test_dimensions_too_large(self):
"""Test rejection of >12000px image (v1.4.2: increased from 4096)"""
large_image = create_test_image(13000, 13000, 'PNG')
with pytest.raises(ValueError) as exc_info:
validate_image(large_image, 'huge.png')
assert "dimensions too large" in str(exc_info.value).lower()
def test_corrupted_image(self):
"""Test rejection of corrupted image data"""
corrupted_data = b'not an image'
with pytest.raises(ValueError) as exc_info:
validate_image(corrupted_data, 'corrupt.jpg')
assert "Invalid or corrupted" in str(exc_info.value)
class TestHEICSupport:
"""Test HEIC/HEIF image format support (v1.4.2)"""
def test_heic_detection_and_conversion(self):
"""Test HEIC file is detected and converted to JPEG"""
heic_data = create_test_heic(800, 600)
file_data, mime_type, width, height = validate_image(heic_data, 'test.heic')
# Should be converted to JPEG
assert mime_type == 'image/jpeg'
assert width == 800
assert height == 600
# file_data should be different (converted to JPEG)
assert file_data != heic_data
# Verify it's actually JPEG by opening it
img = Image.open(io.BytesIO(file_data))
assert img.format == 'JPEG'
def test_heic_with_rgba_mode(self):
"""Test HEIC with alpha channel is converted to RGB JPEG"""
if not HEIC_SUPPORTED:
pytest.skip("pillow-heif not available")
import pillow_heif
# Create image with alpha channel
img = Image.new('RGBA', (800, 600), color=(255, 0, 0, 128))
buffer = io.BytesIO()
heif_file = pillow_heif.from_pillow(img)
heif_file.save(buffer, format='HEIF')
buffer.seek(0)
heic_data = buffer.getvalue()
file_data, mime_type, width, height = validate_image(heic_data, 'test.heic')
# Should be converted to JPEG (no alpha)
assert mime_type == 'image/jpeg'
# Verify it's RGB (no alpha)
img = Image.open(io.BytesIO(file_data))
assert img.mode == 'RGB'
def test_heic_dimensions_preserved(self):
"""Test HEIC conversion preserves dimensions"""
heic_data = create_test_heic(1024, 768)
file_data, mime_type, width, height = validate_image(heic_data, 'photo.heic')
assert width == 1024
assert height == 768
assert mime_type == 'image/jpeg'
def test_heic_error_without_library(self, monkeypatch):
"""Test appropriate error when HEIC uploaded but pillow-heif not available"""
# Mock HEIC_SUPPORTED to False
from starpunk import media
monkeypatch.setattr(media, 'HEIC_SUPPORTED', False)
# Create a mock HEIC file (just needs to be recognized as HEIC by Pillow)
# We'll create a real HEIC if library is available, otherwise skip
if not HEIC_SUPPORTED:
pytest.skip("pillow-heif not available to create test HEIC")
heic_data = create_test_heic(800, 600)
with pytest.raises(ValueError) as exc_info:
validate_image(heic_data, 'test.heic')
assert "HEIC/HEIF images require pillow-heif library" in str(exc_info.value)
assert "convert to JPEG" in str(exc_info.value)
def test_heic_full_upload_flow(self, app):
"""Test complete HEIC upload through save_media"""
heic_data = create_test_heic(800, 600)
with app.app_context():
media_info = save_media(heic_data, 'iphone_photo.heic')
# Should be saved as JPEG
assert media_info['mime_type'] == 'image/jpeg'
assert media_info['width'] == 800
assert media_info['height'] == 600
# Verify file was saved
media_path = Path(app.config['DATA_PATH']) / 'media' / media_info['path']
assert media_path.exists()
# Verify it's actually a JPEG file
saved_img = Image.open(media_path)
assert saved_img.format == 'JPEG'
class TestImageOptimization:
"""Test optimize_image function"""
def test_no_resize_needed(self):
"""Test image within limits is not resized"""
image_data = create_test_image(1024, 768, 'PNG')
optimized, width, height, optimized_bytes = optimize_image(image_data)
assert width == 1024
assert height == 768
assert optimized_bytes is not None
assert len(optimized_bytes) > 0
def test_resize_large_image(self):
"""Test auto-resize of >2048px image (per ADR-058)"""
large_image = create_test_image(3000, 2000, 'PNG')
optimized, width, height, optimized_bytes = optimize_image(large_image)
# Should be resized to 2048px on longest edge
assert width == RESIZE_DIMENSION
# Height should be proportionally scaled
assert height == int(2000 * (RESIZE_DIMENSION / 3000))
assert optimized_bytes is not None
def test_aspect_ratio_preserved(self):
"""Test aspect ratio is maintained during resize"""
image_data = create_test_image(3000, 1500, 'PNG')
optimized, width, height, optimized_bytes = optimize_image(image_data)
# Original aspect ratio: 2:1
# After resize: should still be 2:1
assert width / height == pytest.approx(2.0, rel=0.01)
assert optimized_bytes is not None
def test_gif_animation_preserved(self):
"""Test GIF animation preservation (per Q12)"""
# For v1.2.0: Just verify GIF is handled without error
# Full animation preservation is complex
gif_data = create_test_image(800, 600, 'GIF')
optimized, width, height, optimized_bytes = optimize_image(gif_data)
assert width > 0
assert height > 0
assert optimized_bytes is not None
class TestMediaSave:
"""Test save_media function"""
def test_save_valid_image(self, app):
"""Test saving valid image"""
image_data = create_test_image(800, 600, 'PNG')
with app.app_context():
media_info = save_media(image_data, 'test.png')
assert media_info['id'] > 0
assert media_info['filename'] == 'test.png'
assert media_info['mime_type'] == 'image/png'
assert media_info['width'] == 800
assert media_info['height'] == 600
assert media_info['size'] > 0
# Check file was created
media_path = Path(app.config['DATA_PATH']) / 'media' / media_info['path']
assert media_path.exists()
def test_uuid_filename(self, app):
"""Test UUID-based filename generation (per Q5)"""
image_data = create_test_image(800, 600, 'PNG')
with app.app_context():
media_info = save_media(image_data, 'original-name.png')
# Stored filename should be different from original
assert media_info['stored_filename'] != 'original-name.png'
# Should end with .png
assert media_info['stored_filename'].endswith('.png')
# Path should be YYYY/MM/uuid.ext (per Q2)
parts = media_info['path'].split('/')
assert len(parts) == 3 # year/month/filename
assert len(parts[0]) == 4 # Year
assert len(parts[1]) == 2 # Month
def test_auto_resize_on_save(self, app):
"""Test image >2048px is automatically resized"""
large_image = create_test_image(3000, 2000, 'PNG')
with app.app_context():
media_info = save_media(large_image, 'large.png')
# Should be resized
assert media_info['width'] == RESIZE_DIMENSION
assert media_info['height'] < 2000
class TestMediaAttachment:
"""Test attach_media_to_note function"""
def test_attach_single_image(self, app, sample_note):
"""Test attaching single image to note"""
image_data = create_test_image(800, 600, 'PNG')
with app.app_context():
# Save media
media_info = save_media(image_data, 'test.png')
# Attach to note
attach_media_to_note(sample_note.id, [media_info['id']], ['Test caption'])
# Verify attachment
media_list = get_note_media(sample_note.id)
assert len(media_list) == 1
assert media_list[0]['id'] == media_info['id']
assert media_list[0]['caption'] == 'Test caption'
assert media_list[0]['display_order'] == 0
def test_attach_multiple_images(self, app, sample_note):
"""Test attaching multiple images (up to 4)"""
with app.app_context():
media_ids = []
captions = []
for i in range(4):
image_data = create_test_image(800, 600, 'PNG')
media_info = save_media(image_data, f'test{i}.png')
media_ids.append(media_info['id'])
captions.append(f'Caption {i}')
attach_media_to_note(sample_note.id, media_ids, captions)
media_list = get_note_media(sample_note.id)
assert len(media_list) == 4
# Verify order
for i, media_item in enumerate(media_list):
assert media_item['display_order'] == i
assert media_item['caption'] == f'Caption {i}'
def test_reject_more_than_4_images(self, app, sample_note):
"""Test rejection of 5th image (per Q6)"""
with app.app_context():
media_ids = []
captions = []
for i in range(5):
image_data = create_test_image(800, 600, 'PNG')
media_info = save_media(image_data, f'test{i}.png')
media_ids.append(media_info['id'])
captions.append('')
with pytest.raises(ValueError) as exc_info:
attach_media_to_note(sample_note.id, media_ids, captions)
assert "Maximum 4 images" in str(exc_info.value)
def test_optional_captions(self, app, sample_note):
"""Test captions are optional (per Q7)"""
image_data = create_test_image(800, 600, 'PNG')
with app.app_context():
media_info = save_media(image_data, 'test.png')
# Attach without caption
attach_media_to_note(sample_note.id, [media_info['id']], [''])
media_list = get_note_media(sample_note.id)
assert media_list[0]['caption'] is None or media_list[0]['caption'] == ''
class TestMediaDeletion:
"""Test delete_media function"""
def test_delete_media_file(self, app):
"""Test deletion of media file and record"""
image_data = create_test_image(800, 600, 'PNG')
with app.app_context():
media_info = save_media(image_data, 'test.png')
media_id = media_info['id']
media_path = Path(app.config['DATA_PATH']) / 'media' / media_info['path']
# Verify file exists
assert media_path.exists()
# Delete media
delete_media(media_id)
# Verify file deleted
assert not media_path.exists()
def test_delete_orphaned_associations(self, app, sample_note):
"""Test cascade deletion of note_media associations"""
image_data = create_test_image(800, 600, 'PNG')
with app.app_context():
media_info = save_media(image_data, 'test.png')
attach_media_to_note(sample_note.id, [media_info['id']], ['Test'])
# Delete media
delete_media(media_info['id'])
# Verify association also deleted
media_list = get_note_media(sample_note.id)
assert len(media_list) == 0
class TestMediaSecurityEscaping:
"""Test HTML/JavaScript escaping in media display (per media-display-fixes.md)"""
def test_caption_html_escaped_in_alt_attribute(self, app, sample_note):
"""
Test that captions containing HTML are properly escaped in alt attributes
Per media-display-fixes.md Security Considerations:
"Alt text must be HTML-escaped in templates"
This prevents XSS attacks via malicious caption content.
"""
from starpunk.media import attach_media_to_note, save_media
image_data = create_test_image(800, 600, 'PNG')
# Create caption with HTML tags that should be escaped
malicious_caption = '
'
with app.app_context():
# Save media with malicious caption
media_info = save_media(image_data, 'test.png')
attach_media_to_note(sample_note.id, [media_info['id']], [malicious_caption])
# Get the rendered note page
client = app.test_client()
response = client.get(f'/note/{sample_note.slug}')
assert response.status_code == 200
# Verify the HTML is escaped in the alt attribute
# The caption should appear as escaped HTML entities, not raw HTML
html = response.data.decode('utf-8')
# Should NOT contain unescaped HTML tags
assert '' not in html
assert '
' not in html
# Should NOT have onerror as an actual HTML attribute (i.e., outside quotes)
# Pattern: onerror= followed by something that isn't part of an alt value
assert 'onerror=' not in html or 'alt=' in html.split('onerror=')[0]
# Should contain escaped versions (Jinja2 auto-escapes by default)
# The HTML tags should be escaped
assert '<script>' in html
assert '<img' in html
def test_caption_quotes_escaped_in_alt_attribute(self, app, sample_note):
"""
Test that captions containing quotes are properly escaped in alt attributes
This prevents breaking out of the alt attribute with malicious quotes.
"""
from starpunk.media import attach_media_to_note, save_media
image_data = create_test_image(800, 600, 'PNG')
# Create caption with quotes that could break alt attribute
caption_with_quotes = 'Image" onload="alert(\'XSS\')'
with app.app_context():
# Save media with caption containing quotes
media_info = save_media(image_data, 'test.png')
attach_media_to_note(sample_note.id, [media_info['id']], [caption_with_quotes])
# Get the rendered note page
client = app.test_client()
response = client.get(f'/note/{sample_note.slug}')
assert response.status_code == 200
html = response.data.decode('utf-8')
# Should NOT contain unescaped onload event
assert 'onload="alert' not in html
# The quote should be properly escaped
# Jinja2 should escape quotes in attributes
assert '"' in html or '"' in html or ''' in html
def test_caption_displayed_on_homepage(self, app, sample_note):
"""
Test that media with captions are properly escaped on homepage too
Per media-display-fixes.md, homepage also displays media using the same macro.
"""
from starpunk.media import attach_media_to_note, save_media
image_data = create_test_image(800, 600, 'PNG')
malicious_caption = '
'
with app.app_context():
media_info = save_media(image_data, 'test.png')
attach_media_to_note(sample_note.id, [media_info['id']], [malicious_caption])
# Get the homepage
client = app.test_client()
response = client.get('/')
assert response.status_code == 200
html = response.data.decode('utf-8')
# Should NOT contain unescaped HTML tag
assert '
' not in html
# Should contain escaped version
assert '<img' in html
class TestMediaLogging:
"""Test media upload logging (v1.4.1)"""
def test_save_media_logs_success(self, app, caplog):
"""Test successful upload logs at INFO level"""
import logging
image_data = create_test_image(800, 600, 'PNG')
with app.app_context():
with caplog.at_level(logging.INFO):
media_info = save_media(image_data, 'test.png')
# Check success log exists
assert "Media upload successful" in caplog.text
assert 'filename="test.png"' in caplog.text
assert f'stored="{media_info["stored_filename"]}"' in caplog.text
assert f'size={media_info["size"]}b' in caplog.text
# optimized flag should be present
assert 'optimized=' in caplog.text
# variants count should be present
assert 'variants=' in caplog.text
def test_save_media_logs_validation_failure(self, app, caplog):
"""Test validation failure logs at WARNING level"""
import logging
# Create invalid data (corrupted image)
invalid_data = b'not an image'
with app.app_context():
with caplog.at_level(logging.WARNING):
with pytest.raises(ValueError):
save_media(invalid_data, 'corrupt.jpg')
# Check validation failure log
assert "Media upload validation failed" in caplog.text
assert 'filename="corrupt.jpg"' in caplog.text
assert f'size={len(invalid_data)}b' in caplog.text
assert 'error=' in caplog.text
def test_save_media_logs_optimization_failure(self, app, caplog, monkeypatch):
"""Test optimization failure logs at WARNING level"""
import logging
from starpunk import media
# Mock optimize_image to raise ValueError
def mock_optimize_image(image_data, original_size=None):
raise ValueError("Image cannot be optimized to target size. Please use a smaller or lower-resolution image.")
monkeypatch.setattr(media, 'optimize_image', mock_optimize_image)
image_data = create_test_image(800, 600, 'PNG')
with app.app_context():
with caplog.at_level(logging.WARNING):
with pytest.raises(ValueError):
save_media(image_data, 'test.png')
# Check optimization failure log
assert "Media upload optimization failed" in caplog.text
assert 'filename="test.png"' in caplog.text
assert f'size={len(image_data)}b' in caplog.text
assert 'error=' in caplog.text
def test_save_media_logs_variant_failure(self, app, caplog, monkeypatch):
"""Test variant generation failure logs at WARNING level but continues"""
import logging
from starpunk import media
# Mock generate_all_variants to raise an exception
def mock_generate_all_variants(*args, **kwargs):
raise RuntimeError("Variant generation failed")
monkeypatch.setattr(media, 'generate_all_variants', mock_generate_all_variants)
image_data = create_test_image(800, 600, 'PNG')
with app.app_context():
with caplog.at_level(logging.INFO): # Need INFO level to capture success log
# Should succeed despite variant failure
media_info = save_media(image_data, 'test.png')
# Check variant failure log
assert "Media upload variant generation failed" in caplog.text
assert 'filename="test.png"' in caplog.text
assert f'media_id={media_info["id"]}' in caplog.text
assert 'error=' in caplog.text
# But success log should also be present
assert "Media upload successful" in caplog.text
# And variants should be 0
assert 'variants=0' in caplog.text
def test_save_media_logs_unexpected_error(self, app, caplog, monkeypatch):
"""Test unexpected error logs at ERROR level"""
import logging
from starpunk import media
from pathlib import Path as OriginalPath
# Mock Path.write_bytes to raise OSError (simulating disk full)
def mock_write_bytes(self, data):
raise OSError("[Errno 28] No space left on device")
monkeypatch.setattr(Path, 'write_bytes', mock_write_bytes)
image_data = create_test_image(800, 600, 'PNG')
with app.app_context():
with caplog.at_level(logging.ERROR):
with pytest.raises(OSError):
save_media(image_data, 'test.png')
# Check unexpected error log
assert "Media upload failed unexpectedly" in caplog.text
assert 'filename="test.png"' in caplog.text
assert 'error_type="OSError"' in caplog.text
assert 'error=' in caplog.text
@pytest.fixture
def sample_note(app):
"""Create a sample note for testing"""
from starpunk.notes import create_note
with app.app_context():
note = create_note("Test note content", published=True)
yield note