/api/download

backend/tests/documents_flow.rs

@@ -199,7 +199,7 @@ async fn upload_and_list_document() -> Result<()> {
         .current_version
         .as_ref()
         .expect("current version detail");
-    assert!(current_version.download_path.starts_with("/download/"));
+    assert!(current_version.download_path.starts_with("/api/download/"));
     assert_eq!(current_version.version_number, 1);
     assert_eq!(current_version.size_bytes, file_bytes.len() as i64);
     assert!(current_version.assets.is_empty());
@@ -231,7 +231,7 @@ async fn upload_and_list_document() -> Result<()> {
         .as_ref()
         .expect("list current version")
         .download_path
-        .starts_with("/download/"));
+        .starts_with("/api/download/"));
 
     let redirect = app.get(&current_version.download_path, None).await?;
     assert_eq!(redirect.status(), StatusCode::TEMPORARY_REDIRECT);
@@ -367,7 +367,7 @@ async fn asset_detail_uses_proxy_urls_when_configured() -> Result<()> {
         .url
         .as_deref()
         .ok_or_else(|| anyhow!("missing url"))?;
-    assert!(url.starts_with("/download/"));
+    assert!(url.starts_with("/api/download/"));
     assert!(object.expires_at.is_none());
 
     app.cleanup().await?;
@@ -1717,6 +1717,50 @@ async fn list_documents_by_status_filter() -> Result<()> {
     app.cleanup().await?;
     Ok(())
 }
+
+#[tokio::test]
+async fn trash_document_requires_active_state() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "trashstate";
+    app.insert_user("trashstate", TestUserRole::Owner).await?;
+    let token = app.login_token("trashstate", password).await?;
+
+    let upload = app
+        .upload_document(
+            "/api/documents",
+            "trash-once.txt",
+            "text/plain",
+            b"trash",
+            None,
+            &token,
+        )
+        .await?;
+    let body = body_to_vec(upload.into_body()).await?;
+    let detail: DocumentDetail = serde_json::from_slice(&body)?;
+
+    let first = app
+        .post_json(
+            &format!("/api/documents/{}/trash", detail.document.id),
+            &json!({}),
+            Some(&token),
+        )
+        .await?;
+    assert_eq!(first.status(), StatusCode::NO_CONTENT);
+
+    let second = app
+        .post_json(
+            &format!("/api/documents/{}/trash", detail.document.id),
+            &json!({}),
+            Some(&token),
+        )
+        .await?;
+    assert_eq!(second.status(), StatusCode::CONFLICT);
+
+    app.cleanup().await?;
+    Ok(())
+}
 #[tokio::test]
 async fn purge_document_removes_data() -> Result<()> {
     let _lock = acquire_db_lock().await;
@@ -2008,7 +2052,7 @@ async fn list_document_versions_and_fetch_detail() -> Result<()> {
     let detail_body = body_to_vec(detail_resp.into_body()).await?;
     let version_detail: DocumentVersionPayload = serde_json::from_slice(&detail_body)?;
     assert_eq!(version_detail.id, version_id);
-    assert!(version_detail.download_path.starts_with("/download/"));
+    assert!(version_detail.download_path.starts_with("/api/download/"));
     assert!(version_detail.assets.is_empty());
 
     app.cleanup().await?;

backend/tests/download_flow.rs

@@ -68,7 +68,7 @@ async fn download_with_invalid_token_is_rejected() -> Result<()> {
     let _lock = acquire_db_lock().await;
     let app = TestApp::new().await?;
 
-    let response = app.get("/download/not-a-token", None).await?;
+    let response = app.get("/api/download/not-a-token", None).await?;
     assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
 
     app.cleanup().await?;