Banners, additional images, and files upload to Dropbox.

Dropbox file IDs are saved with the article in Supabase.
Banners appear in thumbnails and behind the article title/subtitle.
Additional images and files appear below the article text.

backend/test_connect_dropbox.py

@@ -0,0 +1,89 @@
+"""OAuth setup must not persist a grant that cannot support article media."""
+import io
+import tempfile
+import unittest
+from contextlib import ExitStack, redirect_stdout
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+from urllib.parse import parse_qs, urlparse
+
+from dotenv import dotenv_values
+from dropbox import DropboxOAuth2FlowNoRedirect
+
+from backend import connect_dropbox
+
+
+class DropboxSetupTests(unittest.TestCase):
+    def setUp(self):
+        self.stack = ExitStack()
+        self.addCleanup(self.stack.close)
+        folder = Path(self.stack.enter_context(tempfile.TemporaryDirectory()))
+        self.env = folder / ".env"
+        self.env.write_text(
+            "DROPBOX_APP_KEY=file-key\nDROPBOX_APP_SECRET=file-secret\n"
+            "DROPBOX_REFRESH_TOKEN=existing-token\n", encoding="utf-8"
+        )
+        self.stack.enter_context(patch.object(connect_dropbox, "__file__", str(folder / "connect_dropbox.py")))
+        self.stack.enter_context(patch.dict("os.environ", {
+            "DROPBOX_APP_KEY": "stale-shell-key", "DROPBOX_APP_SECRET": "stale-shell-secret"
+        }))
+        self.stack.enter_context(patch.object(connect_dropbox.getpass, "getpass", return_value="auth-code"))
+        self.browser = self.stack.enter_context(patch.object(connect_dropbox.webbrowser, "open"))
+        self.output = self.stack.enter_context(redirect_stdout(io.StringIO()))
+        # Exercise real SDK URL generation, but never exchange a real code.
+        self.finish = self.stack.enter_context(patch.object(DropboxOAuth2FlowNoRedirect, "finish"))
+        self.finish.return_value = SimpleNamespace(
+            refresh_token="new-token", scope=["files.content.read", "files.content.write"]
+        )
+
+    def test_opens_default_permissions_offline_url_for_env_file_app(self):
+        connect_dropbox.main()
+        url = urlparse(self.browser.call_args.args[0])
+        self.assertEqual(url.hostname, "www.dropbox.com")
+        self.assertEqual(parse_qs(url.query), {
+            "client_id": ["file-key"], "response_type": ["code"], "token_access_type": ["offline"]
+        })
+        settings = dotenv_values(self.env)
+        self.assertEqual(settings["DROPBOX_REFRESH_TOKEN"], "new-token")
+        self.assertEqual(settings["JOURNAL_MEDIA_STORAGE"], "dropbox")
+        for secret in ("new-token", "existing-token", "file-secret", "auth-code"):
+            self.assertNotIn(secret, self.output.getvalue())
+
+    def test_missing_permissions_preserves_existing_credentials(self):
+        original = self.env.read_bytes()
+        self.finish.return_value.scope = ["account_info.read"]
+        with self.assertRaisesRegex(SystemExit, "files.content.read, files.content.write"):
+            connect_dropbox.main()
+        self.assertEqual(self.env.read_bytes(), original)
+
+    def test_unknown_permissions_preserves_existing_credentials(self):
+        original = self.env.read_bytes()
+        self.finish.return_value.scope = None
+        with self.assertRaisesRegex(SystemExit, "did not grant"):
+            connect_dropbox.main()
+        self.assertEqual(self.env.read_bytes(), original)
+
+    def test_string_scopes_are_accepted(self):
+        self.finish.return_value.scope = "files.content.read files.content.write"
+        connect_dropbox.main()
+        self.assertEqual(dotenv_values(self.env)["DROPBOX_REFRESH_TOKEN"], "new-token")
+
+    def test_exchange_failure_does_not_print_secret_or_overwrite_token(self):
+        original = self.env.read_bytes()
+        self.finish.side_effect = RuntimeError("sensitive-response-token")
+        with self.assertRaises(SystemExit) as error:
+            connect_dropbox.main()
+        self.assertNotIn("sensitive-response-token", str(error.exception))
+        self.assertEqual(self.env.read_bytes(), original)
+
+    def test_missing_refresh_token_preserves_existing_credentials(self):
+        original = self.env.read_bytes()
+        self.finish.return_value.refresh_token = None
+        with self.assertRaisesRegex(SystemExit, "did not issue a refresh token"):
+            connect_dropbox.main()
+        self.assertEqual(self.env.read_bytes(), original)
+
+
+if __name__ == "__main__":
+    unittest.main()