Products: images need https addresses; lowering a rating waits for review; library shows creators

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/api/test/products.test.ts

@@ -119,11 +119,11 @@ test("catalogs register uploads; products have revisions, info and libraries", a
 
   // Descriptions are cleaned by the allowlist.
   const edited = await call(maker, "PATCH", `/api/v1/products/${id}`, {
-    description: `<p style="color:red;position:fixed">Warm <b>coat</b><script>alert(1)</script><a href="javascript:x">x</a><a href="https://example.test" onclick="x()">site</a><img src="http://x/a.png"></p>`,
+    description: `<p style="color:red;position:fixed">Warm <b>coat</b><script>alert(1)</script><a href="javascript:x">x</a><a href="https://example.test" onclick="x()">site</a><img src="http://x/a.png"><img src="relative.png"><img src="https://img.test/a.png"></p>`,
   });
   expect(edited.status).toBe(200);
   expect(edited.json.product.description).toBe(
-    `<p style="color:red">Warm <b>coat</b><a rel="nofollow ugc noopener noreferrer" target="_blank">x</a><a href="https://example.test" rel="nofollow ugc noopener noreferrer" target="_blank">site</a></p>`,
+    `<p style="color:red">Warm <b>coat</b><a rel="nofollow ugc noopener noreferrer" target="_blank">x</a><a href="https://example.test" rel="nofollow ugc noopener noreferrer" target="_blank">site</a><img src="https://img.test/a.png" /></p>`,
   );
   expect((await call(kid, "PATCH", `/api/v1/products/${id}`, { name: "Mine now" })).status).toBe(403);
 
@@ -138,7 +138,7 @@ test("catalogs register uploads; products have revisions, info and libraries", a
 
   // The library: get it, the proxy resolves it to the latest, or the revision the person stays on.
   expect((await call(kid, "PUT", `/api/v1/library/${id}`)).status).toBe(200);
-  expect((await call(kid, "GET", "/api/v1/library")).json.library.map((l: any) => l.product.id)).toEqual([id]);
+  expect((await call(kid, "GET", "/api/v1/library")).json.library.map((l: any) => [l.product.id, l.product.creator])).toEqual([[id, "maker"]]);
   let files2 = (await call(kid, "GET", `/api/v1/products/${id}/files`)).json;
   expect(files2).toMatchObject({ product: id, revision: 2, parent: 500, name: "Blue Coat", creator: "maker", catalogs: ["http://localhost:4102"] });
   expect((await call(kid, "PATCH", `/api/v1/library/${id}`, { stayOn: 1 })).status).toBe(200);
@@ -165,6 +165,9 @@ test("catalogs register uploads; products have revisions, info and libraries", a
   expect((await call(undefined, "GET", "/api/v1/products")).json.products.map((p: any) => p.name)).toEqual(["Blue Coat"]);
   expect((await call(maker, "GET", "/api/v1/products?q=lac")).json.products.map((p: any) => p.name)).toEqual(["Lace"]);
 
+  // Lowering a rating waits for review.
+  expect((await call(maker, "PATCH", `/api/v1/products/${adultID}`, { rating: "general" })).json.error).toBe("review_needed");
+
   expect((await call(kid, "DELETE", `/api/v1/library/${id}`)).status).toBe(204);
   expect((await call(kid, "GET", "/api/v1/library")).json.library).toEqual([]);
 });