fix: add authenticated product image contract

backend/tests/test_product_archive.py

@@ -332,12 +332,67 @@ def test_product_detail_contract_includes_images_and_archive_versions(
     assert detail["images"][0]["is_cover"] is True
     assert len(detail["versions"]) == 1
     version = detail["versions"][0]
+    preview_image = detail["images"][0]
+    expected_image_url = f"/api/products/{product['product_id']}/images/{preview_image['image_id']}"
     assert version["version_id"] == archived.json()["version_id"]
+    assert version["design_preview_image_id"] == preview_image["image_id"]
+    assert version["design_preview_url"] == expected_image_url
     assert version["wordcloud_count"] == 1
     assert version["wordcloud_archives"][0]["source_job_id"] == "job-success"
     assert Path(version["design_preview_path"]).name == "design-preview.png"
 
 
+def test_product_detail_image_contract_is_authenticated_and_path_safe(
+    product_archive_client, prepared_wordcloud_job, tmp_path
+):
+    product = create_product(product_archive_client)
+    archive_product_version(
+        product_archive_client, product["product_id"], prepared_wordcloud_job.document
+    )
+    detail = product_archive_client.get(
+        f"/api/products/{product['product_id']}", headers=orders_auth_header()
+    ).json()
+    image = detail["images"][0]
+
+    assert image["image_url"] == f"/api/products/{product['product_id']}/images/{image['image_id']}"
+
+    served = product_archive_client.get(
+        f"/api/products/{product['product_id']}/images/{image['image_id']}",
+        headers=orders_auth_header(),
+    )
+    assert served.status_code == 200
+    assert served.headers["content-type"] == "image/png"
+    assert served.content == product_archive_client.archive_root.joinpath(
+        product["product_id"], image["version_id"], "design-preview.png"
+    ).read_bytes()
+
+    outside_path = tmp_path / "outside.png"
+    outside_path.write_bytes(PNG_BYTES)
+    product_archive_client.product_store._execute(
+        "UPDATE product_images SET image_path = ? WHERE image_id = ?",
+        (str(outside_path), image["image_id"]),
+    )
+    unsafe = product_archive_client.get(
+        f"/api/products/{product['product_id']}/images/{image['image_id']}",
+        headers=orders_auth_header(),
+    )
+    assert unsafe.status_code == 404
+
+    unknown = product_archive_client.get(
+        f"/api/products/{product['product_id']}/images/img_unknown",
+        headers=orders_auth_header(),
+    )
+    assert unknown.status_code == 404
+
+    unauthenticated_detail = product_archive_client.get(
+        f"/api/products/{product['product_id']}"
+    )
+    unauthenticated_image = product_archive_client.get(
+        f"/api/products/{product['product_id']}/images/{image['image_id']}"
+    )
+    assert unauthenticated_detail.status_code == unauthenticated_image.status_code == 403
+
+
 def test_product_routes_require_orders_auth(product_archive_client):
     product = create_product(product_archive_client)
     requests = [