claude-sonnet-5 review: Phase 2 by gpt-5.3-codex

tests/ui/test_media_urls.py

@@ -1,6 +1,85 @@
-from pathlib import Path
-
 from transcription.ui.components.media_urls import public_media_path_label
+from transcription.ui.components.media_urls import resolve_media_url
+
+
+def test_resolve_media_url_maps_managed_absolute_path_to_upload_route(tmp_path):
+    upload_dir = tmp_path / "uploads"
+    managed_path = upload_dir / "documents" / "abc" / "page.jpg"
+    managed_path.parent.mkdir(parents=True, exist_ok=True)
+    managed_path.write_bytes(b"x")
+
+    resolved = resolve_media_url(str(managed_path), upload_dir=upload_dir, base_url="http://localhost:8000")
+    assert resolved == "http://localhost:8000/uploads/documents/abc/page.jpg"
+
+
+def test_resolve_media_url_rejects_unmanaged_absolute_path(tmp_path):
+    upload_dir = tmp_path / "uploads"
+    managed_path = upload_dir / "documents" / "abc" / "page.jpg"
+    managed_path.parent.mkdir(parents=True, exist_ok=True)
+    managed_path.write_bytes(b"x")
+    unmanaged_path = tmp_path / "other-root" / "secret" / "page.jpg"
+    unmanaged_path.parent.mkdir(parents=True, exist_ok=True)
+    unmanaged_path.write_bytes(b"x")
+
+    resolved = resolve_media_url(str(unmanaged_path), upload_dir=upload_dir, base_url="http://localhost:8000")
+    assert resolved is None
+
+
+def test_resolve_media_url_rejects_stale_relative_path(tmp_path):
+    upload_dir = tmp_path / "uploads"
+
+    resolved = resolve_media_url(
+        "documents/missing/page.jpg",
+        upload_dir=upload_dir,
+        base_url="http://localhost:8000",
+    )
+    assert resolved is None
+
+
+def test_resolve_media_url_rejects_basename_collision_from_unmanaged_path(tmp_path):
+    upload_dir = tmp_path / "uploads"
+    managed_path = upload_dir / "documents" / "abc" / "shared-name.jpg"
+    managed_path.parent.mkdir(parents=True, exist_ok=True)
+    managed_path.write_bytes(b"managed")
+
+    unmanaged_path = tmp_path / "scratch" / "shared-name.jpg"
+    unmanaged_path.parent.mkdir(parents=True, exist_ok=True)
+    unmanaged_path.write_bytes(b"unmanaged")
+
+    resolved = resolve_media_url(
+        str(unmanaged_path),
+        upload_dir=upload_dir,
+        base_url="http://localhost:8000",
+    )
+    assert resolved is None
+
+
+def test_resolve_media_url_accepts_existing_upload_relative_path(tmp_path):
+    upload_dir = tmp_path / "uploads"
+    managed_path = upload_dir / "documents" / "abc" / "page.jpg"
+    managed_path.parent.mkdir(parents=True, exist_ok=True)
+    managed_path.write_bytes(b"x")
+
+    resolved = resolve_media_url(
+        "documents/abc/page.jpg",
+        upload_dir=upload_dir,
+        base_url="http://localhost:8000",
+    )
+    assert resolved == "http://localhost:8000/uploads/documents/abc/page.jpg"
+
+
+def test_resolve_media_url_accepts_existing_portraits_relative_path(tmp_path):
+    upload_dir = tmp_path / "uploads"
+    managed_path = upload_dir / "portraits" / "person" / "seeded.png"
+    managed_path.parent.mkdir(parents=True, exist_ok=True)
+    managed_path.write_bytes(b"x")
+
+    resolved = resolve_media_url(
+        "portraits/person/seeded.png",
+        upload_dir=upload_dir,
+        base_url="http://localhost:8000",
+    )
+    assert resolved == "http://localhost:8000/uploads/portraits/person/seeded.png"
 
 
 def test_public_media_path_label_maps_managed_absolute_path_to_upload_route(tmp_path):