Add safe archive preview and extraction workflows

tests/test_storage_backends.py

@@ -1,19 +1,26 @@
 from __future__ import annotations
 
 import io
+from types import ModuleType
+import sys
 import unittest
 from unittest.mock import MagicMock, PropertyMock, patch
 
 from govoplan_files.backend.storage.backends import S3StorageBackend, StorageBackendError
 
 
-def _backend() -> S3StorageBackend:
+def _backend(
+    *,
+    endpoint_url: str = "https://objects.example.test",
+    deployment_managed: bool = False,
+) -> S3StorageBackend:
     return S3StorageBackend(
         bucket="files",
-        endpoint_url="https://objects.example.test",
+        endpoint_url=endpoint_url,
         region_name="test",
         access_key_id="access",
         secret_access_key="secret",
+        deployment_managed=deployment_managed,
     )
 
 
@@ -32,6 +39,48 @@ class S3StorageBackendTests(unittest.TestCase):
             ), self.assertRaisesRegex(StorageBackendError, "until that transport supports.*DNS/IP pinning"):
                 _backend().client
 
+    def test_installer_managed_garage_uses_exact_endpoint_and_path_style(self) -> None:
+        boto3 = ModuleType("boto3")
+        boto3.client = MagicMock(return_value=object())
+        botocore = ModuleType("botocore")
+        botocore.__path__ = []
+        botocore_config = ModuleType("botocore.config")
+
+        class Config:
+            def __init__(self, **values):
+                self.values = values
+
+        botocore_config.Config = Config
+        with patch.dict(
+            sys.modules,
+            {
+                "boto3": boto3,
+                "botocore": botocore,
+                "botocore.config": botocore_config,
+            },
+        ):
+            _backend(
+                endpoint_url="http://garage:3900",
+                deployment_managed=True,
+            ).client
+
+        _args, kwargs = boto3.client.call_args
+        self.assertEqual("http://garage:3900", kwargs["endpoint_url"])
+        self.assertEqual(
+            {"s3": {"addressing_style": "path"}},
+            kwargs["config"].values,
+        )
+
+    def test_installer_managed_garage_rejects_any_other_endpoint(self) -> None:
+        with self.assertRaisesRegex(
+            StorageBackendError,
+            "restricted to http://garage:3900",
+        ):
+            _backend(
+                endpoint_url="http://other-s3:3900",
+                deployment_managed=True,
+            ).client
+
     def test_get_bytes_rejects_declared_oversize_object_without_reading(self) -> None:
         body = MagicMock()
         client = MagicMock()