Fix purple

server-rs/src/routes/pb_proxy.rs

@@ -27,6 +27,7 @@ fn is_allowed_pb_path(path: &str) -> bool {
     const ALLOWED_PREFIXES: &[&str] = &[
         "/api/collections/users/",
         "/api/collections/saved_searches/",
+        "/api/collections/clicked_listings/",
         "/api/files/",
     ];
     ALLOWED_PREFIXES
@@ -146,3 +147,53 @@ pub async fn proxy_to_pocketbase(
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Every collection the frontend reads or writes directly must be reachable. Adding a
+    /// user-owned collection in pocketbase.rs without an entry here fails silently: the proxy
+    /// 404s before PocketBase is reached, and the SDK error surfaces as "the feature just
+    /// doesn't persist". clicked_listings shipped that way and never stored a row.
+    #[test]
+    fn frontend_used_collections_are_reachable() {
+        for collection in ["users", "saved_searches", "clicked_listings"] {
+            let records = format!("/api/collections/{collection}/records");
+            assert!(
+                is_allowed_pb_path(&records),
+                "{collection} records must be proxy-reachable"
+            );
+        }
+    }
+
+    #[test]
+    fn privileged_and_unknown_paths_are_rejected() {
+        for path in [
+            "/api/collections/checkout_sessions/records",
+            "/api/collections/invites/records",
+            "/api/admins",
+            "/api/settings",
+            "/api/backups",
+            "/_/",
+        ] {
+            assert!(!is_allowed_pb_path(path), "{path} must not be proxied");
+        }
+    }
+
+    /// The trailing slash on each prefix withholds the schema endpoint while allowing the
+    /// records below it. Dropping it would expose every collection's field definitions.
+    #[test]
+    fn collection_schema_endpoints_are_withheld() {
+        assert!(!is_allowed_pb_path("/api/collections/users"));
+        assert!(!is_allowed_pb_path("/api/collections/clicked_listings"));
+    }
+
+    #[test]
+    fn exact_paths_still_allowed() {
+        assert!(is_allowed_pb_path("/api/health"));
+        assert!(is_allowed_pb_path("/api/realtime"));
+        assert!(is_allowed_pb_path("/api/oauth2-redirect"));
+        assert!(is_allowed_pb_path("/api/files/abc/def/file.png"));
+    }
+}