Photo slots + admin page: place any upload in the strip or a live slot, sign up in place, brand links home

docker/backend/test/security.mjs

@@ -224,8 +224,29 @@ try {
   const rows = adminList.body?.photos ?? [];
   check('an admin lists contributions', adminList.status === 200 && rows.length > 0);
   check('the admin listing carries the owner', rows.some((r) => /@test\.local$/.test(r.email ?? '')));
+  check('a fresh upload lands in the strip slot', rows.find((r) => r.id === id)?.slot === 'strip');
   check('a plain member cannot delete', (await user.req(`/admin/photos/${id}`, { method: 'DELETE' })).status === 403);
 
+  // ---- placement ----------------------------------------------------------
+  const patch = (path, body) =>
+    admin.req(path, { method: 'PATCH', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
+  check(
+    'a plain member cannot place a photo',
+    (await user.req(`/admin/photos/${id}`, {
+      method: 'PATCH',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ slot: 'qr' }),
+    })).status === 403,
+  );
+  const placed = await patch(`/admin/photos/${id}`, { slot: 'qr' });
+  check('an admin moves a photo to a live slot', placed.status === 200 && placed.body?.slot === 'qr', JSON.stringify(placed.body));
+  check(
+    'the slot is public, the owner is not',
+    ((await actor().req('/photos')).body?.photos ?? []).find((r) => r.id === id)?.slot === 'qr',
+  );
+  check('an unknown slot is refused', (await patch(`/admin/photos/${id}`, { slot: 'nope' })).status === 400);
+  check('placing an unknown photo is a 404', (await patch('/admin/photos/999999', { slot: 'qr' })).status === 404);
+
   const deleted = await admin.req(`/admin/photos/${id}`, { method: 'DELETE' });
   check('an admin deletes a contribution', deleted.status === 204, `got ${deleted.status}`);
   check('the deleted file is gone from disk', (await fetch(`${BASE}/photos/${id}/file`)).status === 404);
@@ -238,6 +259,12 @@ try {
   for (let i = 0; i < 13; i++) last = (await quota.upload(PNG, 'image/png')).status;
   check('uploads are capped per account', last === 429, `13th upload: ${last}`);
 
+  // The cap is a member fair-use rule; the curator stocks the landing page from
+  // one account, so it must not apply to the allowlist.
+  let adminLast = 0;
+  for (let i = 0; i < 13; i++) adminLast = (await admin.upload(PNG, 'image/png')).status;
+  check('the admin is exempt from the member quota', adminLast === 201, `13th admin upload: ${adminLast}`);
+
   const cleared = await admin.req('/admin/photos', { method: 'DELETE' });
   check('an admin clears the strip in one call', cleared.status === 200 && cleared.body?.removed > 0, JSON.stringify(cleared.body));
   check('the strip is empty afterwards', ((await actor().req('/photos')).body?.photos ?? []).length === 0);