feat: thumbnails added

webui/backend/tests/golden/test_api_settings_golden.py

@@ -0,0 +1,59 @@
+from __future__ import annotations
+
+import asyncio
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+import httpx
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[3]))
+
+from backend.app.dependencies import get_settings_service
+from backend.app.db.settings_repository import SettingsRepository
+from backend.app.main import app
+from backend.app.services.settings_service import SettingsService
+
+
+class SettingsApiGoldenTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temp_dir = tempfile.TemporaryDirectory()
+        repository = SettingsRepository(str(Path(self.temp_dir.name) / "tasks.db"))
+        service = SettingsService(repository=repository)
+
+        async def _override_settings_service() -> SettingsService:
+            return service
+
+        app.dependency_overrides[get_settings_service] = _override_settings_service
+
+    def tearDown(self) -> None:
+        app.dependency_overrides.clear()
+        self.temp_dir.cleanup()
+
+    def _request(self, method: str, url: str, payload: dict | None = None) -> httpx.Response:
+        async def _run() -> httpx.Response:
+            transport = httpx.ASGITransport(app=app)
+            async with httpx.AsyncClient(transport=transport, base_url="http://testserver") as client:
+                if method == "GET":
+                    return await client.get(url)
+                return await client.post(url, json=payload)
+
+        return asyncio.run(_run())
+
+    def test_settings_default_response(self) -> None:
+        response = self._request("GET", "/api/settings")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json(), {"show_thumbnails": False})
+
+    def test_settings_update_persistence(self) -> None:
+        response = self._request("POST", "/api/settings", {"show_thumbnails": True})
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json(), {"show_thumbnails": True})
+        self.assertEqual(self._request("GET", "/api/settings").json(), {"show_thumbnails": True})
+
+
+if __name__ == "__main__":
+    unittest.main()

webui/backend/tests/golden/test_api_thumbnail_golden.py

@@ -0,0 +1,83 @@
+from __future__ import annotations
+
+import asyncio
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+import httpx
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[3]))
+
+from backend.app.dependencies import get_file_ops_service
+from backend.app.fs.filesystem_adapter import FilesystemAdapter
+from backend.app.main import app
+from backend.app.security.path_guard import PathGuard
+from backend.app.services.file_ops_service import FileOpsService
+
+
+class ThumbnailApiGoldenTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temp_dir = tempfile.TemporaryDirectory()
+        self.root = Path(self.temp_dir.name) / "root"
+        self.root.mkdir(parents=True, exist_ok=True)
+        service = FileOpsService(path_guard=PathGuard({"storage1": str(self.root)}), filesystem=FilesystemAdapter())
+
+        async def _override_file_ops_service() -> FileOpsService:
+            return service
+
+        app.dependency_overrides[get_file_ops_service] = _override_file_ops_service
+
+    def tearDown(self) -> None:
+        app.dependency_overrides.clear()
+        self.temp_dir.cleanup()
+
+    def _request(self, path: str) -> httpx.Response:
+        async def _run() -> httpx.Response:
+            transport = httpx.ASGITransport(app=app)
+            async with httpx.AsyncClient(transport=transport, base_url="http://testserver") as client:
+                return await client.get("/api/files/thumbnail", params={"path": path})
+
+        return asyncio.run(_run())
+
+    def test_thumbnail_success_for_supported_image(self) -> None:
+        image = self.root / "poster.jpg"
+        image.write_bytes(b"\xff\xd8\xff\xe0thumbnail")
+
+        response = self._request("storage1/poster.jpg")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.headers["content-type"], "image/jpeg")
+        self.assertEqual(response.content, b"\xff\xd8\xff\xe0thumbnail")
+
+    def test_thumbnail_not_found(self) -> None:
+        response = self._request("storage1/missing.jpg")
+
+        self.assertEqual(response.status_code, 404)
+        self.assertEqual(response.json()["error"]["code"], "path_not_found")
+
+    def test_thumbnail_traversal_blocked(self) -> None:
+        response = self._request("storage1/../etc/passwd")
+
+        self.assertEqual(response.status_code, 403)
+        self.assertEqual(response.json()["error"]["code"], "path_traversal_detected")
+
+    def test_thumbnail_invalid_root_alias(self) -> None:
+        response = self._request("unknown/file.jpg")
+
+        self.assertEqual(response.status_code, 403)
+        self.assertEqual(response.json()["error"]["code"], "invalid_root_alias")
+
+    def test_thumbnail_non_image_blocked(self) -> None:
+        text_file = self.root / "notes.txt"
+        text_file.write_text("hello", encoding="utf-8")
+
+        response = self._request("storage1/notes.txt")
+
+        self.assertEqual(response.status_code, 409)
+        self.assertEqual(response.json()["error"]["code"], "unsupported_type")
+
+
+if __name__ == "__main__":
+    unittest.main()

webui/backend/tests/golden/test_ui_smoke_golden.py

@@ -63,6 +63,8 @@ class UiSmokeGoldenTest(unittest.TestCase):
         self.assertIn('id="rename-apply-btn"', body)
         self.assertIn('id="settings-general-tab"', body)
         self.assertIn('id="settings-logs-tab"', body)
+        self.assertIn('id="settings-show-thumbnails"', body)
+        self.assertIn("Show thumbnails", body)
         self.assertIn('id="settings-logs-list"', body)
         self.assertIn('id="viewer-content"', body)
         self.assertIn('id="editor-modal"', body)
@@ -113,6 +115,12 @@ class UiSmokeGoldenTest(unittest.TestCase):
         self.assertIn("document.documentElement.dataset.theme", app_js)
         self.assertIn('document.getElementById("theme-toggle").onclick = toggleTheme;', app_js)
         self.assertIn('document.getElementById("settings-btn").onclick = () => openSettings("general");', app_js)
+        self.assertIn('async function loadSettings()', app_js)
+        self.assertIn('await loadSettings();', app_js)
+        self.assertIn('settings.showThumbnailsInput.onchange = handleShowThumbnailsChange;', app_js)
+        self.assertIn('"/api/settings"', app_js)
+        self.assertIn('`/api/files/thumbnail?', app_js)
+        self.assertIn('function createMediaSlot(entry)', app_js)
         self.assertIn('function openSearch()', app_js)
         self.assertIn('async function submitSearch()', app_js)
         self.assertIn('async function openInfo()', app_js)
@@ -149,6 +157,9 @@ class UiSmokeGoldenTest(unittest.TestCase):
         self.assertIn('#theme-toggle', style_css)
         self.assertIn('.settings-card', style_css)
         self.assertIn('.settings-tabs', style_css)
+        self.assertIn('.entry-media-slot', style_css)
+        self.assertIn('.entry-media-icon.folder', style_css)
+        self.assertIn('.entry-media-icon.file', style_css)
 
         app_js_url = app.url_path_for("ui", path="/app.js")
         style_css_url = app.url_path_for("ui", path="/style.css")