release(main): 同步 dev 最新候选改动

frontend/src/api/attachments.test.ts

@@ -0,0 +1,56 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const apiDelete = vi.fn();
+const apiGet = vi.fn();
+const apiPost = vi.fn();
+
+vi.mock("./axios", () => ({
+  apiDelete,
+  apiGet,
+  apiPost,
+}));
+
+describe("attachments api", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("downloads attachment blobs without putting credentials in the URL", async () => {
+    const { downloadAttachment } = await import("./attachments");
+
+    downloadAttachment("attachment-1");
+
+    expect(apiGet).toHaveBeenCalledWith("/api/v1/attachments/attachment-1/download", {
+      responseType: "blob",
+    });
+    expect(apiGet.mock.calls[0][0]).not.toContain("token");
+    expect(apiGet.mock.calls[0][0]).not.toContain("access_token");
+  });
+
+  it("uploads attachments as multipart form data", async () => {
+    const { uploadAttachment } = await import("./attachments");
+    const file = new File(["content"], "report.pdf", { type: "application/pdf" });
+    const onUploadProgress = vi.fn();
+
+    uploadAttachment("study-1", "startup_initiation", "entity-1", file, { onUploadProgress });
+
+    expect(apiPost).toHaveBeenCalledWith(
+      "/api/v1/studies/study-1/startup_initiation/entity-1/attachments/",
+      expect.any(FormData),
+      {
+        headers: { "Content-Type": "multipart/form-data" },
+        onUploadProgress,
+      },
+    );
+    const formData = apiPost.mock.calls[0][1] as FormData;
+    expect(formData.get("file")).toBe(file);
+  });
+
+  it("deletes attachments through the scoped attachment endpoint", async () => {
+    const { deleteAttachment } = await import("./attachments");
+
+    deleteAttachment("attachment-1");
+
+    expect(apiDelete).toHaveBeenCalledWith("/api/v1/attachments/attachment-1");
+  });
+});