test(share): assert the masked share path by its exact shape

The substring check tripped on the scratch files' own names, which start
with `sharing-`; the exact-equality assertion on `/<owner>/<uid>/<name>`
already proves nothing above the share leaks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Daniel Salazar
2026-08-15 14:10:27 -07:00
co-authored by Claude Fable 5
parent 9195896ab5
commit 17d7a9d333
@@ -142,12 +142,12 @@ export default suite('sharing', {
);
t.assert.ok(listed && shared, 'the share should be listed');
// The owner's folder is not in it, but the backend still resolves it.
t.assert.ok(
!shared!.path.includes('/sharing-'),
`path should be masked, got ${shared!.path}`,
// The exact masked shape: owner, entry uid, leaf name — and nothing
// of the owner's tree between them. The backend still resolves it.
t.assert.equal(
shared!.path,
`${home(t)}/${shared!.uid_entry}/${shared!.name}`,
);
t.assert.equal(shared!.path, `${home(t)}/${shared!.uid_entry}/${shared!.name}`);
const read = await fetch(
`${t.env.apiOrigin}/read?${new URLSearchParams({ file: shared!.path })}`,