fix(scanner): accept Epson inbox GET preflight

backend/tests/scannerInbox.test.ts

@@ -53,7 +53,7 @@ const protocolFixture = async () => {
 test("WebDAV authentication happens before body parsing, including discovery requests", async t => {
     const { app } = await protocolFixture()
     t.after(() => app.close())
-    for (const method of ["OPTIONS", "PROPFIND", "PUT", "HEAD"] as const) {
+    for (const method of ["OPTIONS", "PROPFIND", "PUT", "HEAD", "GET"] as const) {
         const res = await app.inject({ method, url: "/scanner-inbox/scan.pdf" })
         assert.equal(res.statusCode, 401)
         assert.match(res.headers["www-authenticate"] as string, /^Basic /)
@@ -62,6 +62,27 @@ test("WebDAV authentication happens before body parsing, including discovery req
     assert.equal(res.statusCode, 401)
 })
 
+test("Epson can authenticate with a GET probe of the inbox without listing documents", async t => {
+    const { app, calls } = await protocolFixture()
+    t.after(() => app.close())
+    for (const url of ["/scanner-inbox", "/scanner-inbox/"]) {
+        const challenge = await app.inject({ method: "GET", url })
+        assert.equal(challenge.statusCode, 401)
+        assert.match(challenge.headers["www-authenticate"] as string, /^Basic /)
+        assert.equal((await app.inject({ method: "GET", url, headers: basic("scanner", "wrong") })).statusCode, 401)
+        const probe = await app.inject({ method: "GET", url, headers: basic() })
+        assert.equal(probe.statusCode, 200)
+        assert.equal(probe.body, "")
+        assert.equal(probe.headers.dav, "1")
+        assert.equal(probe.headers["cache-control"], "no-store")
+        assert.equal(probe.headers.location, undefined)
+        const options = await app.inject({ method: "OPTIONS", url, headers: basic() })
+        assert.ok((options.headers.allow as string).split(/,\s*/).includes("GET"))
+    }
+    assert.equal(calls.length, 0)
+    assert.equal((await app.inject({ method: "GET", url: "/scanner-inbox/missing.pdf", headers: basic() })).statusCode, 404)
+})
+
 test("Epson discovery works with both slash forms, XML bodies and a backend proxy prefix", async t => {
     const { app } = await protocolFixture()
     t.after(() => app.close())
@@ -90,7 +111,7 @@ test("raw PDFs reach storage unchanged and scanner credentials cannot download o
         assert.equal(calls.at(-1)[1], "Rechnung & Beleg.pdf")
         assert.deepEqual(calls.at(-1)[2], samplePdf)
     }
-    for (const method of ["GET", "DELETE", "POST", "PATCH"] as const) {
+    for (const method of ["DELETE", "POST", "PATCH"] as const) {
         assert.equal((await app.inject({ method, url: "/scanner-inbox/", headers: basic() })).statusCode, 405)
     }
     for (const name of ["sub/scan.pdf", "sub%2Fscan.pdf", "..%5Cscan.pdf"]) {
@@ -190,6 +211,10 @@ test("scanner inbox integration: migration, persistence, isolation, retries and
         assert.equal(listing.json().total, 1)
         assert.equal(listing.json().documents[0].name, "scan.pdf")
         assert.equal((await app.inject({ method: "HEAD", url: "/scanner-inbox/scan.pdf", headers: basic(first.username, first.password) })).statusCode, 200)
+        const download = await app.inject({ method: "GET", url: "/scanner-inbox/scan.pdf", headers: basic(first.username, first.password) })
+        assert.equal(download.statusCode, 405)
+        assert.ok(!(download.headers.allow as string).split(/,\s*/).includes("GET"))
+        assert.notDeepEqual(download.rawPayload, pdf)
     })
     await t.test("serialises simultaneous retries and preserves existing content on filename conflicts", async () => {
         const retry = await Promise.all([send("scan.pdf"), send("scan.pdf")])