add /v3/sources-public api and tests

shared/middleware/files_api.rb

@@ -17,6 +17,8 @@ def max_app_size
     2_000_000_000 # 2 GB
   end
 
+  SOURCES_PUBLIC_CACHE_DURATION = 20.seconds
+
   def get_bucket_impl(endpoint)
     case endpoint
     when 'animations'
@@ -141,6 +143,15 @@ def record_event(quota_event_type, quota_type, encrypted_channel_id)
     get_file(endpoint, encrypted_channel_id, filename)
   end
 
+  #
+  # GET /v3/sources-public/<channel-id>/<filename>
+  #
+  # Read the latest version of a source file, and cache the response.
+  #
+  get %r{/v3/sources-public/([^/]+)/([^/]+)$} do |encrypted_channel_id, filename|
+    get_file('sources', encrypted_channel_id, filename, cache_duration: SOURCES_PUBLIC_CACHE_DURATION)
+  end
+
   #
   # GET /<channel-id>/<filename>?version=<version-id>
   #
@@ -180,12 +191,13 @@ def record_event(quota_event_type, quota_type, encrypted_channel_id)
   #
   # @return [IO] requested file body as an IO stream
   #
-  def get_file(endpoint, encrypted_channel_id, filename, code_projects_domain_root_route = false)
+  def get_file(endpoint, encrypted_channel_id, filename, code_projects_domain_root_route = false, cache_duration: nil)
     # We occasionally serve HTML files through theses APIs - we don't want NewRelic JS inserted...
     NewRelic::Agent.ignore_enduser rescue nil
 
     buckets = get_bucket_impl(endpoint).new
-    set_object_cache_duration buckets.cache_duration_seconds
+    cache_duration ||= buckets.cache_duration_seconds
+    set_object_cache_duration cache_duration
 
     # Append `no-transform` to existing Cache-Control header
     response['Cache-Control'] += ', no-transform'

shared/test/test_sources.rb

@@ -93,6 +93,44 @@ def test_source_versions
     delete_all_source_versions(filename)
   end
 
+  def test_sources_public
+    filename = MAIN_JSON
+    file_data = '{"someData":"abc 123"}'
+    file_headers = {'CONTENT_TYPE' => 'application/json'}
+    max_age = 20
+    s_max_age = 10
+
+    @api.put_object(filename, file_data, file_headers)
+    assert successful?
+
+    # owner can view
+    @api.get_object(filename)
+    assert successful?
+    assert_equal(file_data, last_response.body)
+    assert_match 'private, must-revalidate, max-age=0', last_response['Cache-Control']
+
+    get "/v3/sources-public/#{@channel}/#{filename}"
+    assert successful?
+    assert_equal(file_data, last_response.body)
+    assert_match "public, max-age=#{max_age}, s-maxage=#{s_max_age}", last_response['Cache-Control']
+
+    # non-owner can view
+    with_session(:non_owner) do
+      non_owner_api = FilesApiTestHelper.new(current_session, 'sources', @channel)
+      non_owner_api.get_object(filename)
+      assert successful?
+      assert_equal(file_data, last_response.body)
+      assert_match 'private, must-revalidate, max-age=0', last_response['Cache-Control']
+
+      get "/v3/sources-public/#{@channel}/#{filename}"
+      assert successful?
+      assert_equal(file_data, last_response.body)
+      assert_match "public, max-age=#{max_age}, s-maxage=#{s_max_age}", last_response['Cache-Control']
+    end
+
+    delete_all_source_versions(filename)
+  end
+
   def test_404_on_malformed_version_id
     filename = MAIN_JSON
     file_data = '{"someData":"abc 123"}'