fix(scanner): normalize Epson collection separators

backend/tests/scannerInbox.test.ts

@@ -101,6 +101,23 @@ test("Epson discovery works with both slash forms, XML bodies and a backend prox
     assert.equal((await app.inject({ method: "PROPFIND", url: "/scanner-inbox/", headers: { ...basic(), depth: "infinity" } })).statusCode, 403)
 })
 
+test("Epson's extra separator does not turn filename checks into false collisions", async t => {
+    const { app, calls } = await protocolFixture()
+    t.after(() => app.close())
+    for (const separator of ["//", "///"]) {
+        const url = `/scanner-inbox${separator}scan.pdf`
+        assert.equal((await app.inject({ method: "HEAD", url, headers: basic() })).statusCode, 404)
+        const upload = await app.inject({ method: "PUT", url, headers: basic(), payload: samplePdf })
+        assert.equal(upload.statusCode, 201)
+        assert.equal(calls.at(-1)[1], "scan.pdf")
+        assert.deepEqual(calls.at(-1)[2], samplePdf)
+        for (const name of ["sub/scan.pdf", "sub%2Fscan.pdf", "..%5Cscan.pdf", ".hidden.pdf", "%2e%2e%2Fscan.pdf"]) {
+            assert.equal((await app.inject({ method: "PUT", url: `/scanner-inbox${separator}${name}`, headers: basic(), payload: samplePdf })).statusCode, 400)
+        }
+    }
+    assert.equal(calls.length, 2)
+})
+
 test("raw PDFs reach storage unchanged and scanner credentials cannot download or delete", async t => {
     const { app, calls } = await protocolFixture()
     t.after(() => app.close())
@@ -211,6 +228,10 @@ test("scanner inbox integration: migration, persistence, isolation, retries and
         assert.equal(listing.json().total, 1)
         assert.equal(listing.json().documents[0].name, "scan.pdf")
         assert.equal((await app.inject({ method: "HEAD", url: "/scanner-inbox/scan.pdf", headers: basic(first.username, first.password) })).statusCode, 200)
+        assert.equal((await app.inject({ method: "HEAD", url: "/scanner-inbox//scan.pdf", headers: basic(first.username, first.password) })).statusCode, 200)
+        assert.equal((await app.inject({ method: "PUT", url: "/scanner-inbox//scan.pdf", headers: basic(first.username, first.password), payload: pdf })).statusCode, 204)
+        assert.equal((await service.list(1, 50, 0)).total, 1)
+        assert.equal((await app.inject({ method: "GET", url: "/scanner-inbox//scan.pdf", headers: basic(first.username, first.password) })).statusCode, 405)
         const download = await app.inject({ method: "GET", url: "/scanner-inbox/scan.pdf", headers: basic(first.username, first.password) })
         assert.equal(download.statusCode, 405)
         assert.ok(!(download.headers.allow as string).split(/,\s*/).includes("GET"))