oss请求处理

tests/private-asset-urls.test.ts

@@ -0,0 +1,24 @@
+import { readFile } from "node:fs/promises";
+import { describe, expect, it } from "vitest";
+
+import { assetPreviewUrl, materialPreviewUrl, storedAssetPreviewUrl } from "@/lib/client/asset-urls";
+
+describe("private asset browser URLs", () => {
+  it("uses the authenticated inline endpoint for stored assets", () => {
+    expect(assetPreviewUrl({ id: "asset/a b" })).toBe("/api/assets/asset%2Fa%20b/download?inline=1");
+    expect(materialPreviewUrl({ id: "asset-1", url: "https://private.test/raw.png" })).toBe("/api/assets/asset-1/download?inline=1");
+    expect(materialPreviewUrl({ url: "https://external.test/reference.png" })).toBe("https://external.test/reference.png");
+    expect(storedAssetPreviewUrl("https://private.test/legacy.png", [{ id: "asset-legacy", url: "https://private.test/legacy.png" }])).toBe("/api/assets/asset-legacy/download?inline=1");
+    expect(storedAssetPreviewUrl("https://external.test/template.png", [])).toBe("https://external.test/template.png");
+  });
+
+  it("does not render persisted private asset URLs directly", async () => {
+    const sources = await Promise.all([
+      readFile(new URL("../components/create-studio.tsx", import.meta.url), "utf8"),
+      readFile(new URL("../components/asset-manager.tsx", import.meta.url), "utf8")
+    ]);
+    for (const source of sources) {
+      expect(source).not.toMatch(/<(?:img|video|audio)[^>]+src=\{asset\.url\}/);
+    }
+  });
+});