From 0f88ec469404dac46252a74fc46b69a06d8dff3a Mon Sep 17 00:00:00 2001
From: Mischa <mischa@gorinskat.nl>
Date: Sat, 4 Jul 2026 20:26:04 +0200
Subject: [PATCH] test(post-form): assert photos are renamed photo-1..N with no
 frontmatter leak

Covers the reorder pipeline: two uploads produce photo-1.jpg/photo-2.jpg on the
posted entry, and the top-level photo_order POST key never appears in the entry
frontmatter. Adds a second image fixture so both slots are exercised.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 tests/fixtures/test-photo-b.jpg    | Bin 0 -> 118 bytes
 tests/ui/post/post-form-ux.spec.js |  29 +++++++++++++++++++++++++++++
 2 files changed, 29 insertions(+)
 create mode 100644 tests/fixtures/test-photo-b.jpg

diff --git a/tests/fixtures/test-photo-b.jpg b/tests/fixtures/test-photo-b.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..ff333a8e2180f586d8311da5845952c083ce6a72
GIT binary patch
literal 118
zcmex=<NpH&0WUXCHwH#V1_nkTWcYuZ!I^=Bjg6g+m4ls~os*M;i${c)hnt&6Qb?Fz
zL{>^(PF6}rMnOeST|r4lSw=>~TvNxu(8R<<Uft5tNWsX)&e+79;r{^!ZVr%%jEsT|
R|8FsHfGlACz)=7HCIHUM6^H-;

literal 0
HcmV?d00001

diff --git a/tests/ui/post/post-form-ux.spec.js b/tests/ui/post/post-form-ux.spec.js
index 1122676..f2b9f68 100644
--- a/tests/ui/post/post-form-ux.spec.js
+++ b/tests/ui/post/post-form-ux.spec.js
@@ -8,6 +8,8 @@ const { fillEditor, waitForPhotoUpload, cleanupEntry, findEntry } = require('../
 
 const TEST_HEIC = path.join(__dirname, '../../fixtures/test-photo.heic');
 const TEST_CORRUPT_HEIC = path.join(__dirname, '../../fixtures/test-corrupt.heic');
+const TEST_JPG = path.join(__dirname, '../../fixtures/test-photo.jpg');
+const TEST_JPG_B = path.join(__dirname, '../../fixtures/test-photo-b.jpg');
 const DRAFT_KEY = 'intotheeast:new-entry-draft';
 
 const created = [];
@@ -87,6 +89,33 @@ test('photo section auto-collapses to a summary after upload and re-expands on t
     await expect(details).toHaveJSProperty('open', true);
 });
 
+// ── Reorder: uploaded photos are renamed photo-1..N; no order field leaks ──────
+test('uploaded photos are renamed photo-1..N and the order field never hits frontmatter', async ({ page }) => {
+    const tag = `rename-${Date.now()}`;
+    await page.goto('/post');
+    await page.fill('input[name="data[title]"]', `UI Test ${tag}`);
+    await fillEditor(page, `photo rename test ${tag}`);
+
+    await page.locator('input.filepond--browser').setInputFiles([TEST_JPG, TEST_JPG_B]);
+    await waitForPhotoUpload(page, 2);
+
+    await page.locator('.btn-post').evaluate(el => el.click());
+    await expect(page.locator('.notices')).toContainText('Entry posted successfully!', { timeout: 15_000 });
+    created.push(tag);
+
+    const dir = findEntry(tag);
+    expect(dir, 'Entry folder should exist').toBeTruthy();
+    const files = fs.readdirSync(dir);
+    // Server renamed both uploads to the deterministic photo-N scheme (drag order).
+    expect(files).toContain('photo-1.jpg');
+    expect(files).toContain('photo-2.jpg');
+
+    // The order is sent as a top-level POST key, so it must not appear in frontmatter.
+    const mdName = files.find(f => /\.md$/.test(f));
+    const md = fs.readFileSync(path.join(dir, mdName), 'utf-8');
+    expect(md).not.toContain('photo_order');
+});
+
 // ── R18: Get Weather is gated on coordinates ──────────────────────────────────
 test('R18: Get Weather is disabled until Get Location provides coordinates', async ({ page, context }) => {
     await context.grantPermissions(['geolocation']);