From 19a8186c666ea2acd591bce217ff3ac7eeed08da Mon Sep 17 00:00:00 2001
From: Edouard Vanbelle <opensource@edouard.vanbelle.fr>
Date: Tue, 25 Aug 2026 00:01:19 +0200
Subject: [PATCH] test(api): upload into an explicit folder in the ETag test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The upload omitted folder_id, which the handler needs to resolve the
file's owner — it answers 500, not a root upload. Every other upload in
the suite passes it; this was the only one that did not, which is why
nothing caught it earlier.

The folder also gives the WebDAV overwrite a deterministic path
(/webdav/hurl-etag-src/<name>) instead of depending on where a
folder-less upload would have landed. Teardown now removes it and
purges it from trash, keeping the shared database clean for the files
that run after.
---
 tests/api/thumbnail_etag_content_keyed.hurl | 44 +++++++++++++++++++--
 1 file changed, 41 insertions(+), 3 deletions(-)

diff --git a/tests/api/thumbnail_etag_content_keyed.hurl b/tests/api/thumbnail_etag_content_keyed.hurl
index b37b6d26..cf8908e9 100644
--- a/tests/api/thumbnail_etag_content_keyed.hurl
+++ b/tests/api/thumbnail_etag_content_keyed.hurl
@@ -41,11 +41,28 @@ token: jsonpath "$.access_token"
 
 
 # ─────────────────────────────────────────────────────────────
-# Step 2 – Upload the first image
+# Step 2 – Upload the first image into a folder of its own.
+#
+# `folder_id` is required — the upload path resolves the owner from the
+# destination folder, so omitting it is a 500, not a root upload. The
+# folder also gives the WebDAV overwrite in step 4 a deterministic path.
 # ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/folders
+Authorization: Bearer {{token}}
+Content-Type: application/json
+{
+  "name": "hurl-etag-src"
+}
+
+HTTP 201
+[Captures]
+folder_id: jsonpath "$.id"
+
+
 POST {{base_url}}/api/files/upload
 Authorization: Bearer {{token}}
 [MultipartFormData]
+folder_id: {{folder_id}}
 file: file,fixtures/red-image.png; image/png
 
 HTTP 201
@@ -80,7 +97,7 @@ HTTP 304
 # ─────────────────────────────────────────────────────────────
 # Step 4 – Replace the content in place, keeping the same file id.
 # ─────────────────────────────────────────────────────────────
-PUT {{base_url}}/webdav/{{file_name}}
+PUT {{base_url}}/webdav/hurl-etag-src/{{file_name}}
 Authorization: Bearer {{token}}
 Content-Type: image/png
 file,fixtures/green-image.png;
@@ -139,7 +156,8 @@ HTTP 304
 
 
 # ─────────────────────────────────────────────────────────────
-# Step 6 – Teardown. Hurl files share one database within run.sh.
+# Step 6 – Teardown. Hurl files share one database within run.sh, so the
+#          folder goes too, and both leave trash empty behind them.
 # ─────────────────────────────────────────────────────────────
 DELETE {{base_url}}/api/files/{{file_id}}
 Authorization: Bearer {{token}}
@@ -159,3 +177,23 @@ DELETE {{base_url}}/api/trash/{{trash_id}}
 Authorization: Bearer {{token}}
 
 HTTP 200
+
+
+DELETE {{base_url}}/api/folders/{{folder_id}}
+Authorization: Bearer {{token}}
+
+HTTP 204
+
+
+GET {{base_url}}/api/trash/resources
+Authorization: Bearer {{token}}
+
+HTTP 200
+[Captures]
+trash_folder_id: jsonpath "$.items[?(@.resource.id == '{{folder_id}}')].resource.id"
+
+
+DELETE {{base_url}}/api/trash/{{trash_folder_id}}
+Authorization: Bearer {{token}}
+
+HTTP 200