feat: add new-tab links and removable media previews (1.7.3)

tests/EditorSecurityTest.php

@@ -145,7 +145,7 @@ final class EditorSecurityTest extends WebTestCase
     public function testLiveSearchDoesNotExposeContentToAnonymousRequests(): void
     {
         $client = self::createClient();
-        foreach (['/admin', '/admin/posts', '/admin/media'] as $url) {
+        foreach (['/admin', '/admin/posts', '/admin/media', '/admin/api/media/'.str_repeat('a', 32)] as $url) {
             $client->request('GET', $url.'?q=secret', server: ['HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest', 'HTTP_ACCEPT' => 'application/json']);
             self::assertResponseRedirects('http://localhost/admin/login');
             self::assertStringNotContainsString('"html":', $client->getResponse()->getContent());
@@ -547,6 +547,22 @@ final class EditorSecurityTest extends WebTestCase
         }
     }
 
+    public function testMediaPreviewReadsSmallAndArchivedImagesWithoutListingTheLibrary(): void
+    {
+        $id = str_repeat('a', 32);
+        $this->db->insert('media', ['id' => $id, 'title' => 'Kleines Logo', 'alt' => 'Logo', 'variants' => json_encode([['src' => '/media/'.$id.'/192', 'width' => 192, 'height' => 64, 'bytes' => 1]]), 'archived' => 1, 'version' => 1, 'created_at' => gmdate('Y-m-d H:i:s')]);
+        $client = $this->login('editor');
+        $client->request('GET', '/admin/api/media/'.$id);
+        self::assertResponseIsSuccessful();
+        $data = json_decode($client->getResponse()->getContent(), true, 512, JSON_THROW_ON_ERROR);
+        self::assertSame($id, $data['item']['id']);
+        self::assertSame(192, $data['item']['variants'][0]['width']);
+        self::assertTrue($data['item']['archived']);
+        self::assertArrayNotHasKey('items', $data);
+        $client->request('GET', '/admin/api/media/'.str_repeat('b', 32));
+        self::assertResponseStatusCodeSame(404);
+    }
+
     public function testTheMediaScreenUploadsAndEditsWithoutJavaScript(): void
     {
         $client = $this->login('editor');