feat: require advanced permission for large uploads

app_test.go

@@ -401,6 +401,39 @@ func TestBasicUploadLimitAndAdvancedInheritance(t *testing.T) {
 	}
 }
 
+func TestLargeFileRequiresAdvancedUpload(t *testing.T) {
+	app, _ := testApp(t)
+	passwordHash, _ := bcrypt.GenerateFromPassword([]byte("password-123"), bcrypt.DefaultCost)
+	basic := User{Username: "basic-size", PasswordHash: string(passwordHash), CanUpload: true}
+	advanced := User{Username: "advanced-size", PasswordHash: string(passwordHash), CanAdvancedUpload: true}
+	for _, user := range []*User{&basic, &advanced} {
+		if err := app.db.Create(user).Error; err != nil {
+			t.Fatal(err)
+		}
+	}
+	router := app.router()
+	fields := map[string]string{"retention": "1h", "downloads": "1"}
+
+	basicCookie := loginAs(t, router, basic.Username, "password-123")
+	body, contentType := uploadBody(t, fields, "allowed.bin", make([]byte, 10*1024*1024))
+	response := request(t, router, http.MethodPost, "/api/files", body, contentType, basicCookie)
+	if response.Code != http.StatusCreated {
+		t.Fatalf("10 MB basic upload status = %d, body = %s", response.Code, response.Body.String())
+	}
+	body, contentType = uploadBody(t, fields, "blocked.bin", make([]byte, 10*1024*1024+1))
+	response = request(t, router, http.MethodPost, "/api/files", body, contentType, basicCookie)
+	if response.Code != http.StatusForbidden || !strings.Contains(response.Body.String(), "高级上传") {
+		t.Fatalf("large basic upload status = %d, body = %s", response.Code, response.Body.String())
+	}
+
+	advancedCookie := loginAs(t, router, advanced.Username, "password-123")
+	body, contentType = uploadBody(t, fields, "allowed-large.bin", make([]byte, 10*1024*1024+1))
+	response = request(t, router, http.MethodPost, "/api/files", body, contentType, advancedCookie)
+	if response.Code != http.StatusCreated {
+		t.Fatalf("large advanced upload status = %d, body = %s", response.Code, response.Body.String())
+	}
+}
+
 func TestDeleteUserRemovesOwnedFilesAndProtectsIDOne(t *testing.T) {
 	app, password := testApp(t)
 	var admin User