Classify missing release IDs when accessing assets

internal/gitea/backend_test.go

@@ -64,6 +64,70 @@ func TestBackendFindReleaseDoesNotRequireWriteResponseFields(t *testing.T) {
 	}
 }
 
+func TestBackendAssetOperationsRequireObservedReleaseID(t *testing.T) {
+	for _, tc := range []struct {
+		name, body string
+		valid      bool
+	}{
+		{"missing", `{"tag_name":"v1.2.3"}`, false},
+		{"zero", `{"id":0,"tag_name":"v1.2.3"}`, false},
+		{"negative", `{"id":-1,"tag_name":"v1.2.3"}`, false},
+		{"valid", `{"id":12,"tag_name":"v1.2.3"}`, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			requests := 0
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if strings.Contains(r.URL.Path, "/releases/tags/") {
+					_, _ = io.WriteString(w, tc.body)
+					return
+				}
+				requests++
+				if r.Method == http.MethodGet {
+					_, _ = io.WriteString(w, `[]`)
+					return
+				}
+				w.WriteHeader(http.StatusCreated)
+				_, _ = io.WriteString(w, `{"id":1,"name":"file"}`)
+			}))
+			defer server.Close()
+			backend := NewBackend(testDestination(server.URL), server.Client())
+			release, err := backend.FindRelease(context.Background(), "v1.2.3")
+			if err != nil {
+				t.Fatal(err)
+			}
+			_, listErr := backend.ListAssets(context.Background(), release.Handle)
+			evidence, uploadErr := backend.UploadAsset(context.Background(), release.Handle, "file", strings.NewReader("data"))
+			if tc.valid {
+				if listErr != nil || uploadErr != nil || requests != 2 {
+					t.Fatalf("valid: list %v, upload %v, requests %d", listErr, uploadErr, requests)
+				}
+				return
+			}
+			for _, err := range []error{listErr, uploadErr} {
+				var failure *forge.Failure
+				if !errors.As(err, &failure) || failure.Kind != forge.FailureMalformed {
+					t.Fatalf("failure = %v", err)
+				}
+			}
+			if requests != 0 || evidence.Attempted || evidence.Disposition != forge.WriteNotAttempted {
+				t.Fatalf("requests = %d, evidence = %#v", requests, evidence)
+			}
+		})
+	}
+	backend := NewBackend(Destination{}, nil)
+	_, listErr := backend.ListAssets(context.Background(), "wrong")
+	evidence, uploadErr := backend.UploadAsset(context.Background(), "wrong", "file", strings.NewReader("data"))
+	for _, err := range []error{listErr, uploadErr} {
+		var failure *forge.Failure
+		if !errors.As(err, &failure) || failure.Kind != forge.FailureInvalid {
+			t.Fatalf("wrong handle failure = %v", err)
+		}
+	}
+	if evidence.Attempted || evidence.Disposition != forge.WriteNotAttempted {
+		t.Fatalf("wrong handle evidence = %#v", evidence)
+	}
+}
+
 func TestBackendListsMetadataAndOpensCallerOwnedAssetStream(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if got, want := r.Header.Get("Authorization"), "token fixture-secret-token"; got != want {