improved tests

storage/src/handlers.rs

@@ -615,3 +615,30 @@ pub async fn get_signed_object(
     
     Ok((headers, body))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_validate_role_allows_valid_roles() {
+        assert!(validate_role("anon").is_ok());
+        assert!(validate_role("authenticated").is_ok());
+        assert!(validate_role("service_role").is_ok());
+    }
+
+    #[test]
+    fn test_validate_role_rejects_sql_injection() {
+        let result = validate_role("anon'; DROP TABLE storage.objects; --");
+        assert!(result.is_err());
+        let (status, _) = result.unwrap_err();
+        assert_eq!(status, StatusCode::FORBIDDEN);
+    }
+
+    #[test]
+    fn test_validate_role_rejects_unknown() {
+        assert!(validate_role("superadmin").is_err());
+        assert!(validate_role("").is_err());
+        assert!(validate_role("postgres").is_err());
+    }
+}

storage/src/tus.rs

@@ -272,3 +272,49 @@ pub async fn tus_head_upload(
 
     Ok((StatusCode::OK, headers))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_validate_upload_id_valid_uuid() {
+        let id = Uuid::new_v4().to_string();
+        assert!(validate_upload_id(&id).is_ok());
+    }
+
+    #[test]
+    fn test_validate_upload_id_rejects_path_traversal() {
+        let result = validate_upload_id("../../etc/passwd");
+        assert!(result.is_err());
+        let (status, _) = result.unwrap_err();
+        assert_eq!(status, StatusCode::BAD_REQUEST);
+    }
+
+    #[test]
+    fn test_validate_upload_id_rejects_arbitrary_string() {
+        assert!(validate_upload_id("not-a-uuid").is_err());
+        assert!(validate_upload_id("").is_err());
+        assert!(validate_upload_id("../../../root/.ssh/id_rsa").is_err());
+    }
+
+    #[test]
+    fn test_get_upload_path_rejects_traversal() {
+        let result = get_upload_path("../../etc/passwd");
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_get_upload_path_valid_uuid() {
+        let id = Uuid::new_v4().to_string();
+        let path = get_upload_path(&id).unwrap();
+        assert!(path.to_string_lossy().contains(&id));
+        assert!(!path.to_string_lossy().contains(".."));
+    }
+
+    #[test]
+    fn test_get_info_path_rejects_traversal() {
+        let result = get_info_path("../../etc/passwd");
+        assert!(result.is_err());
+    }
+}