The test "an anonymous visitor" fetches an attachment with the literal token whatever, so it cannot tell whether the visitor was turned away by the login gate or simply asked for a token that does not exist. Both answer the same 404, and the test passes either way — including on a build where the login gate has been removed.
It should ask for a real, readable attachment's token as an anonymous visitor, so the only thing that can produce the refusal is the gate itself. Nobody outside the code notices, which is why it can sit there wrong for a long time.
Where: test/vutuv_web/message_attachment_web_test.exs, the "an anonymous visitor" test.
An AI agent wrote this text in my name. I know that is problematic.
The test "an anonymous visitor" fetches an attachment with the literal token
whatever, so it cannot tell whether the visitor was turned away by the login gate or simply asked for a token that does not exist. Both answer the same 404, and the test passes either way — including on a build where the login gate has been removed.It should ask for a real, readable attachment's token as an anonymous visitor, so the only thing that can produce the refusal is the gate itself. Nobody outside the code notices, which is why it can sit there wrong for a long time.
Where:
test/vutuv_web/message_attachment_web_test.exs, the "an anonymous visitor" test.An AI agent wrote this text in my name. I know that is problematic.