Bootstrap copied BFF and local accounts with public Sendico contracts (#34)

backend/edge/shared/storage/s3key/key_test.go

@@ -0,0 +1,42 @@
+package s3key
+
+import "testing"
+
+func TestJoinConfinesReferenceToPrefix(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name      string
+		prefix    string
+		reference string
+		want      string
+		wantError bool
+	}{
+		{name: "nested reference", prefix: "compliance-evidence", reference: "account/evidence", want: "compliance-evidence/account/evidence"},
+		{name: "empty reference", prefix: "accounts", wantError: true},
+		{name: "absolute reference", prefix: "accounts", reference: "/private", wantError: true},
+		{name: "parent reference", prefix: "compliance-evidence", reference: "../accounts/avatar", wantError: true},
+		{name: "normalized parent reference", prefix: "accounts", reference: "customer/../avatar", wantError: true},
+		{name: "nested parent escape", prefix: "compliance-evidence", reference: "account/../../accounts/avatar", wantError: true},
+		{name: "invalid prefix", prefix: "../private", reference: "object", wantError: true},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			got, err := Join(test.prefix, test.reference)
+			if test.wantError {
+				if err == nil {
+					t.Fatalf("Join(%q, %q) error = nil", test.prefix, test.reference)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("Join(%q, %q) error = %v", test.prefix, test.reference, err)
+			}
+			if got != test.want {
+				t.Fatalf("Join(%q, %q) = %q, want %q", test.prefix, test.reference, got, test.want)
+			}
+		})
+	}
+}