From f15baec58ef2204a519520588c26ae67d85084d1 Mon Sep 17 00:00:00 2001
From: Daniel Markstedt <markstedt@gmail.com>
Date: Thu, 26 Jan 2023 18:10:53 -0800
Subject: [PATCH] Web UI: Introduce separate endpoint for downloading files
 from the config dir (#1075)

Web UI: Introduce separate endpoint for downloading files from the config dir
---
 python/web/src/templates/index.html |  6 ++---
 python/web/src/web.py               | 19 ++++++++++---
 python/web/tests/api/test_files.py  | 42 ++++++++++++++++++++++++++---
 3 files changed, 58 insertions(+), 9 deletions(-)

diff --git a/python/web/src/templates/index.html b/python/web/src/templates/index.html
index 01f5511f..be98df14 100644
--- a/python/web/src/templates/index.html
+++ b/python/web/src/templates/index.html
@@ -222,8 +222,8 @@
                     {% for key in file["prop"] %}
                         <li>{{ key }}: {{ file['prop'][key] }}</li>
                     {% endfor %}
-                    <form action="/files/download" method="post">
-                        <input name="file" type="hidden" value="{{ CFG_DIR }}/{{ file['name'].replace(env['image_dir'], '') }}.{{ PROPERTIES_SUFFIX }}">
+                    <form action="/files/download_config" method="post">
+                        <input name="file" type="hidden" value="{{ file['name'] }}.{{ PROPERTIES_SUFFIX }}">
                         <input type="submit" value="{{ _("Properties File") }} &#8595;">
                     </form>
                     </ul>
@@ -271,7 +271,7 @@
             <td>{{ file["name"] }}</td>
             {% endif %}
             <td align="center">
-                <form action="/files/download" method="post">
+                <form action="/files/download_image" method="post">
                     <input name="file" type="hidden" value="{{ file['name'] }}">
                     <input type="submit" value="{{ file['size_mb'] }} {{ _("MiB") }} &#8595;">
                 </form>
diff --git a/python/web/src/web.py b/python/web/src/web.py
index d87d8dd6..52dbcf96 100644
--- a/python/web/src/web.py
+++ b/python/web/src/web.py
@@ -1104,11 +1104,11 @@ def create_file():
     )
 
 
-@APP.route("/files/download", methods=["POST"])
+@APP.route("/files/download_image", methods=["POST"])
 @login_required
-def download():
+def download_image():
     """
-    Downloads a file from the system to the local computer
+    Downloads a file from the image dir to the local computer
     """
     file_name = Path(request.form.get("file"))
     safe_path = is_safe_path(file_name)
@@ -1118,6 +1118,19 @@ def download():
     return send_from_directory(server_info["image_dir"], str(file_name), as_attachment=True)
 
 
+@APP.route("/files/download_config", methods=["POST"])
+@login_required
+def download_config():
+    """
+    Downloads a file from the config dir to the local computer
+    """
+    file_name = Path(request.form.get("file"))
+    safe_path = is_safe_path(file_name)
+    if not safe_path["status"]:
+        return response(error=True, message=safe_path["msg"])
+    return send_from_directory(CFG_DIR, str(file_name), as_attachment=True)
+
+
 @APP.route("/files/delete", methods=["POST"])
 @login_required
 def delete():
diff --git a/python/web/tests/api/test_files.py b/python/web/tests/api/test_files.py
index af75a2c3..0bdc3edd 100644
--- a/python/web/tests/api/test_files.py
+++ b/python/web/tests/api/test_files.py
@@ -281,11 +281,11 @@ def test_upload_file(http_client, delete_file):
     delete_file(file_name)
 
 
-# route("/files/download", methods=["POST"])
-def test_download_file(http_client, create_test_image):
+# route("/files/download_image", methods=["POST"])
+def test_download_image(http_client, create_test_image):
     file_name = create_test_image()
 
-    response = http_client.post("/files/download", data={"file": file_name})
+    response = http_client.post("/files/download_image", data={"file": file_name})
 
     assert response.status_code == 200
     assert response.headers["content-type"] == "application/octet-stream"
@@ -293,6 +293,42 @@ def test_download_file(http_client, create_test_image):
     assert response.headers["content-length"] == str(FILE_SIZE_1_MIB)
 
 
+# route("/files/download_config", methods=["POST"])
+def test_download_properties(http_client, list_files, delete_file):
+    file_prefix = str(uuid.uuid4())
+    file_name = f"{file_prefix}.hds"
+
+    response = http_client.post(
+        "/files/create",
+        data={
+            "file_name": file_prefix,
+            "type": "hds",
+            "size": 1,
+            "drive_name": "Miniscribe M8425",
+        },
+    )
+
+    response_data = response.json()
+
+    assert response.status_code == 201
+    assert response_data["status"] == STATUS_SUCCESS
+    assert response_data["data"]["image"] == file_name
+    assert (
+        response_data["messages"][0]["message"]
+        == f"Image file with properties created: {file_name}"
+    )
+    assert file_name in list_files()
+
+    response = http_client.post("/files/download_config", data={"file": f"{file_name}.properties"})
+
+    assert response.status_code == 200
+    assert response.headers["content-type"] == "application/octet-stream"
+    assert response.headers["content-disposition"] == f"attachment; filename={file_name}.properties"
+
+    # Cleanup
+    delete_file(file_name)
+
+
 # route("/files/download_url", methods=["POST"])
 def test_download_url_to_dir(env, httpserver, http_client, list_files, delete_file):
     file_name = str(uuid.uuid4())