fix: signed URLs for private bucket, 10MB server-side limit, safe auth destructuring

tests/lib/supabase/storage.test.ts

@@ -2,21 +2,21 @@ import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { uploadEvidenceFile, getEvidenceUrl } from '@/lib/supabase/storage'
 
 const mockUpload = vi.fn()
-const mockGetPublicUrl = vi.fn()
+const mockCreateSignedUrl = vi.fn()
 const mockSupabase = {
   storage: {
     from: vi.fn(() => ({
       upload: mockUpload,
-      getPublicUrl: mockGetPublicUrl,
+      createSignedUrl: mockCreateSignedUrl,
     })),
   },
-  auth: { getUser: vi.fn().mockResolvedValue({ data: { user: { id: 'user-123' } } }) },
+  auth: { getUser: vi.fn().mockResolvedValue({ data: { user: { id: 'user-123' } }, error: null }) },
 } as any
 
 beforeEach(() => {
   vi.clearAllMocks()
   mockUpload.mockResolvedValue({ data: { path: 'user-123/incident-abc/report/photo.jpg' }, error: null })
-  mockGetPublicUrl.mockReturnValue({ data: { publicUrl: 'https://example.com/photo.jpg' } })
+  mockCreateSignedUrl.mockResolvedValue({ data: { signedUrl: 'https://example.com/photo.jpg' }, error: null })
 })
 
 describe('uploadEvidenceFile', () => {
@@ -29,6 +29,7 @@ describe('uploadEvidenceFile', () => {
       file,
       expect.objectContaining({ contentType: 'image/jpeg', upsert: false })
     )
+    expect(mockCreateSignedUrl).toHaveBeenCalledWith(expect.stringContaining('user-123/incident-abc/report/'), 315360000)
     expect(result.path).toContain('user-123/incident-abc/report/')
     expect(result.hash).toBeTruthy()
   })
@@ -38,12 +39,18 @@ describe('uploadEvidenceFile', () => {
     const file = new File(['x'], 'f.jpg', { type: 'image/jpeg' })
     await expect(uploadEvidenceFile(mockSupabase, file, 'inc', 'report')).rejects.toThrow('Bucket not found')
   })
+
+  it('throws when photo exceeds 10MB', async () => {
+    const bigFile = new File([new Uint8Array(11 * 1024 * 1024)], 'big.jpg', { type: 'image/jpeg' })
+    await expect(uploadEvidenceFile(mockSupabase, bigFile, 'inc', 'report')).rejects.toThrow('File too large')
+  })
 })
 
 describe('getEvidenceUrl', () => {
-  it('returns signed public URL', () => {
-    const url = getEvidenceUrl(mockSupabase, 'user-123/incident-abc/report/photo.jpg')
+  it('returns signed URL for path', async () => {
+    const url = await getEvidenceUrl(mockSupabase, 'user-123/incident-abc/report/photo.jpg')
     expect(mockSupabase.storage.from).toHaveBeenCalledWith('evidence')
+    expect(mockCreateSignedUrl).toHaveBeenCalledWith('user-123/incident-abc/report/photo.jpg', 3600)
     expect(url).toBe('https://example.com/photo.jpg')
   })
 })