Show poster thumbnails in the detail panes

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/arr/image_test.go

@@ -0,0 +1,96 @@
+package arr
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestSmallVariant(t *testing.T) {
+	for in, want := range map[string]string{
+		"/MediaCover/1/poster.jpg?lastWrite=5": "/MediaCover/1/poster-250.jpg?lastWrite=5",
+		"/MediaCover/1/poster.jpg":             "/MediaCover/1/poster-250.jpg",
+		"/MediaCover/1/fanart.jpg":             "/MediaCover/1/fanart.jpg",
+	} {
+		if got := smallVariant(in); got != want {
+			t.Errorf("smallVariant(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestPosterLocalUsesAPIKey(t *testing.T) {
+	var paths []string
+	var keys []string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		paths = append(paths, r.URL.RequestURI())
+		keys = append(keys, r.Header.Get("X-Api-Key"))
+		if r.URL.Path == "/MediaCover/1/poster-250.jpg" {
+			http.NotFound(w, r) // no small variant: fall back to the original
+			return
+		}
+		w.Write([]byte("IMG"))
+	}))
+	defer srv.Close()
+
+	c := NewClient(srv.URL, "secret")
+	imgs := []Image{{CoverType: "fanart", URL: "/MediaCover/1/fanart.jpg"}, {CoverType: "poster", URL: "/MediaCover/1/poster.jpg?lastWrite=1", RemoteURL: "https://remote/p.jpg"}}
+	key, fetch, ok := c.Poster(imgs, true)
+	if !ok || key == "" {
+		t.Fatal("no poster")
+	}
+	data, err := fetch(context.Background())
+	if err != nil || string(data) != "IMG" {
+		t.Fatalf("data=%q err=%v", data, err)
+	}
+	if len(paths) != 2 || paths[0] != "/MediaCover/1/poster-250.jpg?lastWrite=1" || paths[1] != "/MediaCover/1/poster.jpg?lastWrite=1" {
+		t.Errorf("requests = %v", paths)
+	}
+	for _, k := range keys {
+		if k != "secret" {
+			t.Errorf("api key header = %q", k)
+		}
+	}
+}
+
+func TestPosterRemoteSendsNoAPIKey(t *testing.T) {
+	var got string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		got = r.Header.Get("X-Api-Key")
+		w.Write([]byte("IMG"))
+	}))
+	defer srv.Close()
+
+	c := NewClient("http://radarr.invalid", "secret")
+	key, fetch, ok := c.Poster([]Image{{CoverType: "poster", URL: "/MediaCover/0/poster.jpg", RemoteURL: srv.URL + "/p.jpg"}}, false)
+	if !ok || key != srv.URL+"/p.jpg" {
+		t.Fatalf("key=%q ok=%v", key, ok)
+	}
+	if _, err := fetch(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if got != "" {
+		t.Errorf("the API key leaked to a remote image host: %q", got)
+	}
+	if _, _, ok := c.Poster([]Image{{CoverType: "banner", RemoteURL: "x"}}, false); ok {
+		t.Error("only posters count")
+	}
+	if _, err := FetchURL(context.Background(), "file:///etc/passwd"); err == nil {
+		t.Error("non-http schemes must be refused")
+	}
+}
+
+func TestResolveURLBase(t *testing.T) {
+	c := NewClient("http://host:7878/radarr", "k")
+	for ref, want := range map[string]string{
+		"/radarr/MediaCover/1/poster.jpg": "http://host:7878/radarr/MediaCover/1/poster.jpg",
+		"/MediaCover/1/poster.jpg":        "http://host:7878/radarr/MediaCover/1/poster.jpg",
+	} {
+		if got, _ := c.resolve(ref); got != want {
+			t.Errorf("resolve(%q) = %q, want %q", ref, got, want)
+		}
+	}
+	if got, _ := NewClient("http://host", "k").resolve("/MediaCover/1/poster.jpg"); got != "http://host/MediaCover/1/poster.jpg" {
+		t.Errorf("no url base: %q", got)
+	}
+}