github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-08-01 19:06:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐛 Make organization logos publicly accessible for invitation emails (#10831)

Browse Source
This commit is contained in:
María Valderrama 2026-07-24 14:08:41 +02:00 committed by GitHub
parent 62880cb58c
commit 66bb6a11df
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
backend/src/app/http/assets.clj
View File

@ -31,7 +31,8 @@
#{"file-media-object" #{"file-media-object"
"file-object-thumbnail" "file-object-thumbnail"
"team-font-variant" "team-font-variant"
"file-data-fragment"}) "file-data-fragment"
"organization"})
(defn get-id (defn get-id
[{:keys [path-params]}] [{:keys [path-params]}]

16
backend/test/backend_tests/http_assets_test.clj
View File

@ -110,7 +110,8 @@
(doseq [bucket ["file-media-object" (doseq [bucket ["file-media-object"
"file-object-thumbnail" "file-object-thumbnail"
"team-font-variant" "team-font-variant"
"file-data-fragment"]] "file-data-fragment"
"organization"]]
(t/testing (str "bucket: " bucket) (t/testing (str "bucket: " bucket)
(let [object (create-storage-object! storage bucket "public data") (let [object (create-storage-object! storage bucket "public data")
request {:path-params {:id (str (:id object))}} request {:path-params {:id (str (:id object))}}
@ -120,6 +121,19 @@
(t/is (not= 404 (::yres/status response)) (t/is (not= 404 (::yres/status response))
(str "bucket " bucket " object should exist"))))))) (str "bucket " bucket " object should exist")))))))
(t/deftest objects-handler-organization-logo-no-auth
;; Organization logos are embedded in unauthenticated contexts, such as
;; the invitation email image shown to a not-yet-registered invitee, so
;; they must be servable without a session or access token.
(let [storage (-> (:app.storage/storage th/*system*)
(configure-storage-backend))
cfg (make-handler-cfg storage)
object (create-storage-object! storage "organization" "logo data")
request {:path-params {:id (str (:id object))}}
response (assets/objects-handler cfg request)]
(t/is (not= 401 (::yres/status response)))
(t/is (not= 404 (::yres/status response)))))
(t/deftest objects-handler-public-bucket-with-auth (t/deftest objects-handler-public-bucket-with-auth
;; Objects in public buckets should also be accessible WITH authentication. ;; Objects in public buckets should also be accessible WITH authentication.
(let [storage (-> (:app.storage/storage th/*system*) (let [storage (-> (:app.storage/storage th/*system*)