优化

src/modules/container-loading/api/platformContainerLoading.test.ts

@@ -136,11 +136,18 @@ describe('platform container loading API', () => {
     expect(http.get).toHaveBeenCalledWith('/platform/v1/containers/7/documents/DELIVERY_ORDER/2/download', { responseType: 'blob' })
   })
 
-  it('downloads PDA photos only from the backend-provided protected container path', async () => {
-    vi.mocked(http.get).mockResolvedValueOnce(new Blob(['photo']))
-    await downloadContainerPdaPhoto('/api/platform/v1/containers/7/pda/photos/23/download')
-    expect(http.get).toHaveBeenCalledWith('/api/platform/v1/containers/7/pda/photos/23/download', { responseType: 'blob' })
-    expect(() => downloadContainerPdaPhoto('/api/platform/v1/files/loading-evidence/21/22/23')).toThrow('invalid container photo path')
-    expect(() => downloadContainerPdaPhoto('https://example.com/photo.jpg')).toThrow('invalid container photo path')
+  it('normalizes the gateway /api prefix once and accepts only exact protected container photo paths', async () => {
+    vi.mocked(http.get).mockResolvedValue(new Blob(['photo']))
+    const longPath = '/api/platform/v1/containers/2092437461590446082/pda/photos/2092439032600797185/download'
+    await downloadContainerPdaPhoto(longPath)
+    await downloadContainerPdaPhoto('/platform/v1/containers/2092437461590446082/pda/photos/2092439032600797185/download')
+    expect(http.get).toHaveBeenNthCalledWith(1, '/platform/v1/containers/2092437461590446082/pda/photos/2092439032600797185/download', { responseType: 'blob' })
+    expect(http.get).toHaveBeenNthCalledWith(2, '/platform/v1/containers/2092437461590446082/pda/photos/2092439032600797185/download', { responseType: 'blob' })
+    expect(vi.mocked(http.get).mock.calls.every((call) => !String(call[0]).includes('/api/api/'))).toBe(true)
+    for (const path of [
+      '/api/platform/v1/files/loading-evidence/21/22/23', 'https://example.com/photo.jpg',
+      '//example.com/platform/v1/containers/7/pda/photos/23/download', '/platform/v1/containers/7/pda/photos/23/download?token=x',
+      '/platform/v1/containers/7/pda/photos/../23/download', '/api/api/platform/v1/containers/7/pda/photos/23/download',
+    ]) expect(() => downloadContainerPdaPhoto(path)).toThrow('invalid container photo path')
   })
 })

src/modules/container-loading/api/platformContainerLoading.ts

@@ -165,9 +165,15 @@ export function downloadContainerDocument(containerId: string, documentType: Ext
   return http.get<Blob, Blob>(`${containerPath}/${encodeURIComponent(containerId)}/documents/${documentType}/${encodeURIComponent(fileId)}/download`, { responseType: 'blob' })
 }
 
+function normalizeContainerPhotoDownloadPath(downloadPath: string) {
+  if (typeof downloadPath !== 'string' || !downloadPath.startsWith('/')) throw new Error('invalid container photo path')
+  const normalized = downloadPath.startsWith('/api/') ? downloadPath.slice(4) : downloadPath
+  if (!/^\/platform\/v1\/containers\/[1-9][0-9]*\/pda\/photos\/[1-9][0-9]*\/download$/.test(normalized)) throw new Error('invalid container photo path')
+  return normalized
+}
+
 export function downloadContainerPdaPhoto(downloadPath: string) {
-  if (!/^\/api\/platform\/v1\/containers\/[1-9][0-9]*\/pda\/photos\/[1-9][0-9]*\/download$/.test(downloadPath)) throw new Error('invalid container photo path')
-  return http.get<Blob, Blob>(downloadPath, { responseType: 'blob' })
+  return http.get<Blob, Blob>(normalizeContainerPhotoDownloadPath(downloadPath), { responseType: 'blob' })
 }
 
 export async function createContainerSimulation(payload: ContainerSimulationCreateRequest) {