Blogs: list personal files under the user's login, not the sub claim

GET api/v1/fs passed User.GetUserId() (the "sub" claim — a GUID in
production) to GetUserFiles, so the listing looked under
{Blog}/{sub-GUID}. But the personal-storage tree is keyed by the
user's login everywhere else: EnsureDestinationDirectory writes under
{Blog}/{name-claim}, the download endpoint and avatar paths use
user.UserName. So once the upload path was fixed (previous commit),
files landed under {Blog}/{login} while the listing still looked under
{Blog}/{GUID} — an empty tree — hence the PostIt "Mes fichiers" page
listing nothing.

GetDir now resolves the user from the DB (as Post already does) and
lists under user.UserName. UploadedFile.OwnerId stays "sub", so
EnrichWithFileIds still queries by uid.

Tests:
- TestTokenIssuer.Issue gains an optional `name` param (defaults to
  subject, preserving existing behavior) so a test token can mirror
  production where sub (GUID) ≠ name (login).
- FileSystemApiTests.Get_fs_lists_files_stored_under_the_user_login
  decouples sub from the login, uploads under the login, and asserts
  GET /api/v1/fs returns the file (and the subject-named directory does
  NOT exist). Verified to fail when the controller uses uid for the
  listing.

Co-Authored-By: Claude Code <noreply@anthropic.com>
This commit is contained in:
Paul Schneider 2026-09-25 20:50:58 +01:00
commit a307885310
Signed by: notazof
GPG key ID: AD4B9B545FBD7D12
3 changed files with 94 additions and 4 deletions

View file

@ -54,7 +54,18 @@ namespace Yavsc.Blogs.Controllers
{
if (!ModelState.IsValid) return new BadRequestObjectResult(ModelState);
var uid = User.GetUserId();
var files = FileSystemHelpers.GetUserFiles(siteSettings, uid, subdir);
// The personal-storage tree is keyed by the user's login
// (UserName): EnsureDestinationDirectory writes under
// {Blog}/{UserName}, the download endpoint and avatar paths
// use user.UserName too. GetUserId() returns the "sub" claim
// (a GUID in production), so passing uid here made the listing
// look under {Blog}/{sub-GUID} — an empty tree, hence the
// "Mes fichiers" page listing nothing. Resolve the login and
// list under it. OwnerId on UploadedFile stays "sub" (uid),
// so EnrichWithFileIds still queries by uid.
var user = dbContext.Users.SingleOrDefault(u => u.Id == uid);
if (user == null) return NotFound();
var files = FileSystemHelpers.GetUserFiles(siteSettings, user.UserName, subdir);
EnrichWithFileIds(files, uid, subdir);
return Ok(files);
}