test: verify search engine API acceptance

tests/security/test_paths.py

@@ -0,0 +1,29 @@
+"""Containment is rechecked when serving a document."""
+
+from pathlib import Path
+from typing import cast
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from recoll_modern.indexing.discovery import ObservedFile
+
+
+def test_swapped_symlink_cannot_escape_document_root(
+    authenticated: tuple[TestClient, str], tmp_path: Path
+) -> None:
+    client, _ = authenticated
+    root = tmp_path / "docs"
+    path = root / "file.txt"
+    path.write_text("safe")
+    digest = "a" * 64
+    cast(FastAPI, client.app).state.documents.observe_files([
+        ObservedFile("file.txt", digest, 4)
+    ])
+    outside = tmp_path / "secret.txt"
+    outside.write_text("secret")
+    path.unlink()
+    path.symlink_to(outside)
+    response = client.get(f"/documents/{digest}/file")
+    assert response.status_code == 410
+    assert b"secret" not in response.content