fix: enforce gallery access and consolidate gallery workflows (#1357)

Harden gallery authentication and authorization, consolidate gallery workflows, and prevent token-bearing URLs from leaking through nginx request error logs.
2026-09-08 15:34:09 +02:00
parent 895e5ab3cc
commit f0e6d2dfb1
120 changed files with 7147 additions and 8525 deletions
@@ -0,0 +1,28 @@
+const EventEmitter = require('events');
+jest.mock('../../src/utils/logger', () => ({ info: jest.fn() }));
+const logger = require('../../src/utils/logger');
+const middleware = require('../../src/middleware/apiRequestLogger');
+const { requestLogPath } = require('../../src/utils/requestLogPath');
+const marker = 'SECRET_TEST_CAPABILITY';
+it.each([
+  `/api/gallery/g/photos?token=${marker}&password=${marker}`,
+  `/api/gallery/g/verify-token/${marker}`,
+  `/api/gallery/g/show/${marker}/state`,
+  `/api/images/g/photo/1/signed/${marker}`,
+  `/api/secure-images/g/secure/1/${marker}`,
+  `/api/secure-images/g/secure-download/1/${marker}`,
+  `/api/public/contracts/${marker}/sign`,
+  `/api/customer/auth/password-reset/${marker}`,
+  `/api/public/newsletter/unsubscribe/${marker}`,
+])('does not log capabilities on request or response: %s', (originalUrl) => {
+  logger.info.mockClear();
+  const res = new EventEmitter(); res.statusCode = 200;
+  middleware({ originalUrl, method: 'GET' }, res, jest.fn());
+  res.emit('finish');
+  expect(logger.info).toHaveBeenCalledTimes(2);
+  expect(JSON.stringify(logger.info.mock.calls)).not.toContain(marker);
+});
+it('retains useful non-secret routes and removes control characters', () => {
+  expect(requestLogPath('/api/admin/events/12?search=private')).toBe('/api/admin/events/12');
+  expect(requestLogPath('/api/admin/events\nforged')).not.toContain('\n');
+});