snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-server/test/integration/metadata/suites/file/__snapshots__/failing-file-by-id-download.integration-spec.ts.snap

@@ -0,0 +1,23 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`File-by-id controller download should fail should respond 403 when the URL fileId does not match the token payload 1`] = `
+{
+  "body": {
+    "error": "Forbidden",
+    "message": "Forbidden resource",
+    "statusCode": 403,
+  },
+  "status": 403,
+}
+`;
+
+exports[`File-by-id controller download should fail should respond 403 when the request has no token query parameter 1`] = `
+{
+  "body": {
+    "error": "Forbidden",
+    "message": "Forbidden resource",
+    "statusCode": 403,
+  },
+  "status": 403,
+}
+`;

packages/twenty-server/test/integration/metadata/suites/file/failing-file-by-id-download.integration-spec.ts

@@ -0,0 +1,124 @@
+import request from 'supertest';
+import {
+  extractPathAndQueryFromUrl,
+  swapFileIdInUrl,
+} from 'test/integration/metadata/suites/file/utils/file-by-id-url-helpers.util';
+import { seedWorkspaceLogo } from 'test/integration/metadata/suites/file/utils/seed-workspace-logo.util';
+import { expectOneNotInternalServerErrorHttpResponseSnapshot } from 'test/integration/utils/expect-one-not-internal-server-error-http-response-snapshot.util';
+import { FileFolder } from 'twenty-shared/types';
+import { v4 as uuidv4 } from 'uuid';
+
+describe('File-by-id controller download should fail', () => {
+  let fileId: string;
+  let validUrlPath: string;
+  let cleanup: () => Promise<void>;
+
+  beforeAll(async () => {
+    jest.useRealTimers();
+
+    const seeded = await seedWorkspaceLogo();
+
+    fileId = seeded.fileId;
+    validUrlPath = extractPathAndQueryFromUrl(seeded.signedUrl);
+    cleanup = seeded.cleanup;
+
+    jest.useFakeTimers();
+  }, 60000);
+
+  afterAll(async () => {
+    await cleanup();
+  });
+
+  it('should respond 403 when the request has no token query parameter', async () => {
+    jest.useRealTimers();
+
+    const response = await request(global.app.getHttpServer()).get(
+      `/file/${FileFolder.CorePicture}/${fileId}`,
+    );
+
+    jest.useFakeTimers();
+
+    expect(response.text ?? '').not.toMatch(/postgres:|secret/i);
+
+    expectOneNotInternalServerErrorHttpResponseSnapshot({
+      status: response.status,
+      body: response.body,
+    });
+  }, 30000);
+
+  it('should respond 403 when the URL fileId does not match the token payload', async () => {
+    jest.useRealTimers();
+
+    const tamperedUrlPath = swapFileIdInUrl(validUrlPath, uuidv4());
+
+    const response = await request(global.app.getHttpServer()).get(
+      tamperedUrlPath,
+    );
+
+    jest.useFakeTimers();
+
+    expect(response.text ?? '').not.toMatch(/postgres:|secret/i);
+
+    expectOneNotInternalServerErrorHttpResponseSnapshot({
+      status: response.status,
+      body: response.body,
+    });
+  }, 30000);
+
+  it('should respond 404 when the file row no longer exists', async () => {
+    jest.useRealTimers();
+
+    await globalThis.testDataSource.query(
+      `UPDATE core."file" SET "deletedAt" = now() WHERE id = $1`,
+      [fileId],
+    );
+
+    try {
+      const response = await request(global.app.getHttpServer()).get(
+        validUrlPath,
+      );
+
+      expect(response.status).toBe(404);
+      expect(response.body.code).toBe('FILE_NOT_FOUND');
+      expect(response.text ?? '').not.toMatch(/postgres:|secret/i);
+    } finally {
+      await globalThis.testDataSource.query(
+        `UPDATE core."file" SET "deletedAt" = NULL WHERE id = $1`,
+        [fileId],
+      );
+
+      jest.useFakeTimers();
+    }
+  }, 30000);
+
+  it('should respond 404 when the storage object is missing while the DB row still exists', async () => {
+    jest.useRealTimers();
+
+    const [{ path: originalPath }] = (await globalThis.testDataSource.query(
+      `SELECT path FROM core."file" WHERE id = $1`,
+      [fileId],
+    )) as [{ path: string }];
+
+    await globalThis.testDataSource.query(
+      `UPDATE core."file" SET path = $1 WHERE id = $2`,
+      [`CorePicture/${uuidv4()}.png`, fileId],
+    );
+
+    try {
+      const response = await request(global.app.getHttpServer()).get(
+        validUrlPath,
+      );
+
+      expect(response.status).toBe(404);
+      expect(response.body.code).toBe('FILE_NOT_FOUND');
+      expect(response.text ?? '').not.toMatch(/postgres:|secret/i);
+    } finally {
+      await globalThis.testDataSource.query(
+        `UPDATE core."file" SET path = $1 WHERE id = $2`,
+        [originalPath, fileId],
+      );
+
+      jest.useFakeTimers();
+    }
+  }, 30000);
+});

packages/twenty-server/test/integration/metadata/suites/file/successful-file-by-id-download.integration-spec.ts

@@ -0,0 +1,136 @@
+import request from 'supertest';
+import { extractPathAndQueryFromUrl } from 'test/integration/metadata/suites/file/utils/file-by-id-url-helpers.util';
+import {
+  ONE_BY_ONE_TRANSPARENT_PNG,
+  seedWorkspaceLogo,
+} from 'test/integration/metadata/suites/file/utils/seed-workspace-logo.util';
+
+describe('File-by-id controller download should succeed', () => {
+  let signedUrl: string;
+  let cleanup: () => Promise<void>;
+
+  beforeAll(async () => {
+    jest.useRealTimers();
+
+    const seeded = await seedWorkspaceLogo();
+
+    signedUrl = seeded.signedUrl;
+    cleanup = seeded.cleanup;
+
+    jest.useFakeTimers();
+  }, 60000);
+
+  afterAll(async () => {
+    await cleanup();
+  });
+
+  it('should stream the workspace logo with correct headers and a non-empty image body', async () => {
+    jest.useRealTimers();
+
+    const response = await request(global.app.getHttpServer())
+      .get(extractPathAndQueryFromUrl(signedUrl))
+      .buffer(true)
+      .parse((res, callback) => {
+        const chunks: Buffer[] = [];
+
+        res.on('data', (chunk) => chunks.push(chunk));
+        res.on('end', () => callback(null, Buffer.concat(chunks)));
+      });
+
+    jest.useFakeTimers();
+
+    expect(response.status).toBe(200);
+    expect(response.headers['content-type']).toContain('image/png');
+    expect(response.headers['x-content-type-options']).toBe('nosniff');
+    expect(response.headers['content-disposition']).toBe('inline');
+
+    const body = response.body as Buffer;
+
+    expect(body.equals(ONE_BY_ONE_TRANSPARENT_PNG)).toBe(true);
+  }, 30000);
+
+  it('should stream a requested byte range using the persisted file size', async () => {
+    jest.useRealTimers();
+
+    const response = await request(global.app.getHttpServer())
+      .get(extractPathAndQueryFromUrl(signedUrl))
+      .set('Range', 'bytes=0-9')
+      .buffer(true)
+      .parse((res, callback) => {
+        const chunks: Buffer[] = [];
+
+        res.on('data', (chunk) => chunks.push(chunk));
+        res.on('end', () => callback(null, Buffer.concat(chunks)));
+      });
+
+    jest.useFakeTimers();
+
+    expect(response.status).toBe(206);
+    expect(response.headers['accept-ranges']).toBe('bytes');
+    expect(response.headers['content-range']).toBe(
+      `bytes 0-9/${ONE_BY_ONE_TRANSPARENT_PNG.length}`,
+    );
+    expect(response.headers['content-length']).toBe('10');
+    expect(response.body).toEqual(ONE_BY_ONE_TRANSPARENT_PNG.subarray(0, 10));
+  }, 30000);
+
+  it('should stream from the requested offset to the end for an open-ended range', async () => {
+    jest.useRealTimers();
+
+    const response = await request(global.app.getHttpServer())
+      .get(extractPathAndQueryFromUrl(signedUrl))
+      .set('Range', 'bytes=10-')
+      .buffer(true)
+      .parse((res, callback) => {
+        const chunks: Buffer[] = [];
+
+        res.on('data', (chunk) => chunks.push(chunk));
+        res.on('end', () => callback(null, Buffer.concat(chunks)));
+      });
+
+    jest.useFakeTimers();
+
+    expect(response.status).toBe(206);
+    expect(response.headers['content-range']).toBe(
+      `bytes 10-${ONE_BY_ONE_TRANSPARENT_PNG.length - 1}/${ONE_BY_ONE_TRANSPARENT_PNG.length}`,
+    );
+    expect(response.body).toEqual(ONE_BY_ONE_TRANSPARENT_PNG.subarray(10));
+  }, 30000);
+
+  it('should ignore a malformed range header and stream the full file', async () => {
+    jest.useRealTimers();
+
+    const response = await request(global.app.getHttpServer())
+      .get(extractPathAndQueryFromUrl(signedUrl))
+      .set('Range', 'bytes=abc')
+      .buffer(true)
+      .parse((res, callback) => {
+        const chunks: Buffer[] = [];
+
+        res.on('data', (chunk) => chunks.push(chunk));
+        res.on('end', () => callback(null, Buffer.concat(chunks)));
+      });
+
+    jest.useFakeTimers();
+
+    expect(response.status).toBe(200);
+    expect((response.body as Buffer).equals(ONE_BY_ONE_TRANSPARENT_PNG)).toBe(
+      true,
+    );
+  }, 30000);
+
+  it('should reject a byte range beyond the persisted file size', async () => {
+    jest.useRealTimers();
+
+    const response = await request(global.app.getHttpServer())
+      .get(extractPathAndQueryFromUrl(signedUrl))
+      .set('Range', `bytes=${ONE_BY_ONE_TRANSPARENT_PNG.length}-`);
+
+    jest.useFakeTimers();
+
+    expect(response.status).toBe(416);
+    expect(response.headers['content-range']).toBe(
+      `bytes */${ONE_BY_ONE_TRANSPARENT_PNG.length}`,
+    );
+  }, 30000);
+});

packages/twenty-server/test/integration/metadata/suites/file/successful-workspace-logo-removal.integration-spec.ts

@@ -0,0 +1,50 @@
+import gql from 'graphql-tag';
+import { seedWorkspaceLogo } from 'test/integration/metadata/suites/file/utils/seed-workspace-logo.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+
+describe('Workspace logo removal should succeed', () => {
+  let workspaceId: string;
+  let cleanup: () => Promise<void>;
+
+  beforeAll(async () => {
+    jest.useRealTimers();
+
+    const seeded = await seedWorkspaceLogo();
+
+    workspaceId = seeded.workspaceId;
+    cleanup = seeded.cleanup;
+
+    jest.useFakeTimers();
+  }, 60000);
+
+  afterAll(async () => {
+    await cleanup();
+  });
+
+  it('should clear logoFileId so the resolver stops signing a deleted file', async () => {
+    jest.useRealTimers();
+
+    const response = await makeMetadataAPIRequest({
+      query: gql`
+        mutation UpdateWorkspace {
+          updateWorkspace(data: { logo: null }) {
+            id
+            logo
+          }
+        }
+      `,
+    });
+
+    jest.useFakeTimers();
+
+    expect(response.body.errors).toBeUndefined();
+    expect(response.body.data.updateWorkspace.logo).toBe('');
+
+    const [workspace] = await globalThis.testDataSource.query(
+      `SELECT "logoFileId" FROM core."workspace" WHERE id = $1`,
+      [workspaceId],
+    );
+
+    expect(workspace.logoFileId).toBeNull();
+  }, 30000);
+});

packages/twenty-server/test/integration/metadata/suites/file/utils/file-by-id-url-helpers.util.ts

@@ -0,0 +1,20 @@
+// Strips host + port from an absolute signed file URL so `supertest` can hit
+// the in-process Nest app via its bound port.
+export const extractPathAndQueryFromUrl = (fullUrl: string): string => {
+  const parsed = new URL(fullUrl);
+
+  return parsed.pathname + parsed.search;
+};
+
+// `/file/<folder>/<fileId>?token=...` → swaps `<fileId>` for a different uuid;
+// the embedded token (signed for the original fileId) stays untouched. Used to
+// exercise the `payload.fileId !== URL.fileId` branch of `FileByIdGuard`.
+export const swapFileIdInUrl = (
+  pathAndQuery: string,
+  newFileId: string,
+): string => {
+  return pathAndQuery.replace(
+    /(\/file\/[^/]+\/)[^?]+(\?|$)/,
+    `$1${newFileId}$2`,
+  );
+};

packages/twenty-server/test/integration/metadata/suites/file/utils/seed-workspace-logo.util.ts

@@ -0,0 +1,58 @@
+import { uploadWorkspaceLogoMutation } from 'test/integration/graphql/utils/upload-workspace-logo-mutation.util';
+import { makeMetadataAPIRequestWithFileUpload } from 'test/integration/metadata/suites/utils/make-metadata-api-request-with-file-upload.util';
+
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+
+// 67-byte 1x1 transparent PNG. Big enough for `file-type` to detect a valid
+// image header, small enough to keep the upload negligible. Exported so the
+// success spec can assert round-trip byte-equality against the served body.
+export const ONE_BY_ONE_TRANSPARENT_PNG = Buffer.from(
+  '89504E470D0A1A0A0000000D49484452000000010000000108060000001F15C4890000000D4944415478DA63000100000005000100200CB81000000000049454E44AE426082',
+  'hex',
+);
+
+type SeededWorkspaceLogo = {
+  fileId: string;
+  signedUrl: string;
+  workspaceId: string;
+  cleanup: () => Promise<void>;
+};
+
+export const seedWorkspaceLogo = async (): Promise<SeededWorkspaceLogo> => {
+  const response = await makeMetadataAPIRequestWithFileUpload(
+    {
+      query: uploadWorkspaceLogoMutation,
+      variables: { file: null },
+    },
+    {
+      field: 'file',
+      buffer: ONE_BY_ONE_TRANSPARENT_PNG,
+      filename: 'logo.png',
+      contentType: 'image/png',
+    },
+  );
+
+  if (response.body.errors !== undefined) {
+    throw new Error(
+      `uploadWorkspaceLogo failed: ${JSON.stringify(response.body.errors)}`,
+    );
+  }
+
+  const { id: fileId, url: signedUrl } = response.body.data
+    .uploadWorkspaceLogo as { id: string; url: string };
+
+  const workspaceId = SEED_APPLE_WORKSPACE_ID;
+
+  const cleanup = async (): Promise<void> => {
+    await globalThis.testDataSource.query(
+      `UPDATE core."workspace" SET "logoFileId" = NULL WHERE id = $1`,
+      [workspaceId],
+    );
+    await globalThis.testDataSource.query(
+      `DELETE FROM core."file" WHERE id = $1`,
+      [fileId],
+    );
+  };
+
+  return { fileId, signedUrl, workspaceId, cleanup };
+};