fix: gather verbs, walk oom, admin path bypass, roulette refund

1 files changed, 22 insertions, 0 deletions

diff --git a/internal/admin/correct_audit_fixes_test.go b/internal/admin/correct_audit_fixes_test.go
new file mode 100644
index 0000000..381fb5c
--- /dev/null
+++ b/internal/admin/correct_audit_fixes_test.go
@@ -0,0 +1,22 @@
+package admin
+
+import "testing"
+
+// Regression: the raw file API must canonicalize repeated "/" and "data/"
+// prefixes, or "//players/..." reaches the real file while the classifiers
+// see a non-player path and skip the redaction / online refusal.
+func TestCanonicalDataRelPathStripsRepeatedPrefixes(t *testing.T) {
+	cases := map[string]string{
+		"players/accounts/x.yaml":           "players/accounts/x.yaml",
+		"/players/accounts/x.yaml":          "players/accounts/x.yaml",
+		"//players/accounts/x.yaml":         "players/accounts/x.yaml",
+		"data/players/accounts/x.yaml":      "players/accounts/x.yaml",
+		"data/data/players/accounts/x.yaml": "players/accounts/x.yaml",
+		"../etc/passwd":                     "etc/passwd",
+	}
+	for in, want := range cases {
+		if got := canonicalDataRelPath(in); got != want {
+			t.Errorf("canonicalDataRelPath(%q) = %q, want %q", in, got, want)
+		}
+	}
+}