feat: batch delete

security_test.sh

@@ -340,6 +340,71 @@ curl -s -X DELETE "$BASE/files/batch1.txt" > /dev/null
 curl -s -X DELETE "$BASE/files/batch2.txt" > /dev/null
 rm -f "$TMPDIR/batch.zip" "$TMPDIR/batch2.zip" "$TMPDIR/batch_q.zip"
 
+# ──────────────────────────────────────────────────────────────
+section "O. 批量删除 (POST /files-delete)"
+# ──────────────────────────────────────────────────────────────
+echo "bdel-1" > "$TMPDIR/bdel1.txt"
+echo "bdel-2" > "$TMPDIR/bdel2.txt"
+upload "$TMPDIR/bdel1.txt" "bdel1.txt" > /dev/null
+upload "$TMPDIR/bdel2.txt" "bdel2.txt" > /dev/null
+
+# 删除其一 + 一个不存在: 200, miss 含不存在项, 目标文件确已被删
+resp=$(curl -s -X POST -H "Content-Type: application/json" \
+  -d '{"files":["bdel1.txt","does-not-exist-bdel.bin"]}' "$BASE/files-delete")
+if echo "$resp" | grep -q '"deleted":1' && echo "$resp" | grep -q 'does-not-exist-bdel.bin'; then
+  ok "POST /files-delete (1 real + 1 miss) -> 200 deleted=1 miss=[...]"
+else
+  ko "batch delete baseline" "resp=$resp"
+fi
+status=$(curl -s -o /dev/null -w "%{http_code}" "$BASE/download/bdel1.txt")
+[[ "$status" == "404" ]] && ok "deleted file no longer downloadable -> 404" || ko "deleted file" "got $status"
+
+# 非法文件名 -> 400
+status=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" \
+  -d '{"files":[".."]}' "$BASE/files-delete")
+[[ "$status" == "400" ]] && ok "invalid filename \"..\" -> 400" || ko "invalid filename" "got $status"
+
+# 超 100 -> 400
+files=$(python3 -c 'import json; print(json.dumps({"files":["x"]*101}))')
+status=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" \
+  -d "$files" "$BASE/files-delete")
+[[ "$status" == "400" ]] && ok "101 files -> 400" || ko "101 files" "got $status"
+
+# 空 body -> 400
+status=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" \
+  -d '{"files":[]}' "$BASE/files-delete")
+[[ "$status" == "400" ]] && ok "empty files array -> 400" || ko "empty files" "got $status"
+
+# 清理
+curl -s -X DELETE "$BASE/files/bdel2.txt" > /dev/null
+
+# ──────────────────────────────────────────────────────────────
+section "P. 静态资源 (/static StaticFS)"
+# ──────────────────────────────────────────────────────────────
+html=$(curl -s "$BASE/")
+if echo "$html" | grep -q 'href="/static/app.css"'; then
+  ok "GET / contains <link href=\"/static/app.css\">"
+else
+  ko "GET / link tag" "link tag missing"
+fi
+for js in app.js helpers.js batch.js; do
+  code=$(status "$BASE/static/$js")
+  [[ "$code" == "200" ]] && ok "GET /static/$js -> 200" || ko "GET /static/$js" "got $code"
+done
+hdrs=$(curl -s -D - -o /dev/null "$BASE/static/app.css")
+ctype=$(echo "$hdrs" | tr -d '\r' | awk -F': ' '/^[Cc]ontent-[Tt]ype/ {print $2}')
+cc=$(echo "$hdrs" | tr -d '\r' | awk -F': ' '/^[Cc]ache-[Cc]ontrol/ {print $2}')
+if echo "$ctype" | grep -qi 'text/css'; then
+  ok "GET /static/app.css -> Content-Type: text/css"
+else
+  ko "app.css content-type" "got [$ctype]"
+fi
+if echo "$cc" | grep -qi 'no-cache'; then
+  ok "GET /static/app.css -> Cache-Control: no-cache"
+else
+  ko "app.css cache-control" "got [$cc]"
+fi
+
 # ──────────────────────────────────────────────────────────────
 echo
 printf "\n\033[1m========== 总计 ==========\033[0m\n"