Preserve private asset metadata headers and verify cross-project adoption

2026-11-09 16:12:36 +08:00
parent cc2ca05cd4
commit efa916060a
3 changed files with 8 additions and 3 deletions
@@ -603,9 +603,12 @@ func TestOnboardingAndSharing(t *testing.T) {
 				t.Fatal(err)
 			}
 			digest := sha256.Sum256(assetPNG.Bytes())
-			if metadata["metadata_version"] != float64(1) || metadata["sha256"] != hex.EncodeToString(digest[:]) || !modelEqual(metadata["asset"], uploaded) || result.Header().Get("Cache-Control") != "private, no-store" {
+			if metadata["metadata_version"] != float64(1) || metadata["sha256"] != hex.EncodeToString(digest[:]) || !modelEqual(metadata["asset"], uploaded) {
 				t.Fatalf("invalid metadata identity: %s", result.Body.String())
 			}
+			if result.Header().Get("Cache-Control") != "private, no-store" {
+				t.Fatalf("invalid metadata privacy header: %q", result.Header().Get("Cache-Control"))
+			}
 		}
 	}
 	// Neither a snapshot nor an asset response may keep the workspace locked