test(webui): cover restricted media previews

tests/webui/test_file_preview.py

@@ -0,0 +1,40 @@
+from pathlib import Path
+
+import pytest
+
+from nanobot.security.workspace_access import default_workspace_scope
+from nanobot.webui.file_preview import WebUIFilePreviewError, file_preview_payload
+
+
+def test_restricted_preview_allows_media_file(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    workspace = tmp_path / "workspace"
+    workspace.mkdir()
+    media = tmp_path / "media"
+    media.mkdir()
+    uploaded = media / "upload.txt"
+    uploaded.write_text("uploaded", encoding="utf-8")
+    monkeypatch.setattr("nanobot.webui.file_preview.get_media_dir", lambda: media)
+
+    scope = default_workspace_scope(workspace, restrict_to_workspace=True)
+
+    payload = file_preview_payload(str(uploaded), scope=scope)
+
+    assert payload["content"] == "uploaded"
+    assert Path(payload["path"]) == uploaded.resolve()
+
+
+def test_restricted_preview_rejects_other_root(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    workspace = tmp_path / "workspace"
+    workspace.mkdir()
+    media = tmp_path / "media"
+    media.mkdir()
+    outside = tmp_path / "outside.txt"
+    outside.write_text("secret", encoding="utf-8")
+    monkeypatch.setattr("nanobot.webui.file_preview.get_media_dir", lambda: media)
+
+    scope = default_workspace_scope(workspace, restrict_to_workspace=True)
+
+    with pytest.raises(WebUIFilePreviewError, match="outside the current workspace") as exc_info:
+        file_preview_payload(str(outside), scope=scope)
+
+    assert exc_info.value.status == 403