From 17d7a9d3336d06ff81fe69a572578e9ce0c278ea Mon Sep 17 00:00:00 2001 From: Daniel Salazar Date: Sat, 15 Aug 2026 14:10:12 -0700 Subject: [PATCH] test(share): assert the masked share path by its exact shape The substring check tripped on the scratch files' own names, which start with `sharing-`; the exact-equality assertion on `///` already proves nothing above the share leaks. Co-Authored-By: Claude Fable 5 --- src/puter-js/tests/api/suites/sharing.suite.ts | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/puter-js/tests/api/suites/sharing.suite.ts b/src/puter-js/tests/api/suites/sharing.suite.ts index 2c366ff8a..664026b36 100644 --- a/src/puter-js/tests/api/suites/sharing.suite.ts +++ b/src/puter-js/tests/api/suites/sharing.suite.ts @@ -142,12 +142,12 @@ export default suite('sharing', { ); t.assert.ok(listed && shared, 'the share should be listed'); - // The owner's folder is not in it, but the backend still resolves it. - t.assert.ok( - !shared!.path.includes('/sharing-'), - `path should be masked, got ${shared!.path}`, + // The exact masked shape: owner, entry uid, leaf name — and nothing + // of the owner's tree between them. The backend still resolves it. + t.assert.equal( + shared!.path, + `${home(t)}/${shared!.uid_entry}/${shared!.name}`, ); - t.assert.equal(shared!.path, `${home(t)}/${shared!.uid_entry}/${shared!.name}`); const read = await fetch( `${t.env.apiOrigin}/read?${new URLSearchParams({ file: shared!.path })}`,