fix(fns): queue uploads from worker-visible path

tests/apps/parsers/test_fns_upload.py

@@ -5,6 +5,7 @@ import os
 import tempfile
 import time
 import zipfile
+from types import SimpleNamespace
 from unittest.mock import patch
 
 from apps.core.models import BackgroundJob
@@ -274,6 +275,54 @@ class FNSUploadIntegrationTest(APITestCase):
 
         self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
 
+    def test_upload_accepts_worker_visible_server_path(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            watch_dir, processed_dir, failed_dir = self._dirs(tmpdir)
+            server_path = os.path.join(watch_dir, "archives", "fin_ropk.zip")
+            with override_settings(
+                FNS_WATCH_DIRECTORY=watch_dir,
+                FNS_PROCESSED_DIRECTORY=processed_dir,
+                FNS_FAILED_DIRECTORY=failed_dir,
+            ), patch(
+                "apps.parsers.fns_upload.uuid.uuid4",
+                return_value="server-path-task-id",
+            ), patch(
+                "apps.parsers.tasks.process_fns_zip_archive.apply_async",
+                return_value=SimpleNamespace(id="server-path-task-id"),
+            ) as task_mock:
+                response = self.client.post(
+                    self.upload_url,
+                    {"server_path": server_path},
+                    format="json",
+                )
+
+        self.assertEqual(response.status_code, status.HTTP_202_ACCEPTED)
+        self.assertEqual(response.data["queued"], 1)
+        self.assertEqual(response.data["task_ids"], ["server-path-task-id"])
+        task_mock.assert_called_once()
+        job = BackgroundJob.objects.get(task_id="server-path-task-id")
+        self.assertEqual(job.user_id, self.admin.id)
+        self.assertEqual(job.meta["server_path"], os.path.realpath(server_path))
+        self.assertEqual(job.meta["upload_type"], "zip_server_path")
+
+    def test_upload_rejects_server_path_outside_fns_directory(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            watch_dir, processed_dir, failed_dir = self._dirs(tmpdir)
+            outside_path = os.path.join(tmpdir, "outside", "fin_ropk.zip")
+            with override_settings(
+                FNS_WATCH_DIRECTORY=watch_dir,
+                FNS_PROCESSED_DIRECTORY=processed_dir,
+                FNS_FAILED_DIRECTORY=failed_dir,
+            ):
+                response = self.client.post(
+                    self.upload_url,
+                    {"server_path": outside_path},
+                    format="json",
+                )
+
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertFalse(BackgroundJob.objects.exists())
+
     def test_upload_skips_when_file_already_exists(self):
         content = _build_fns_excel_bytes()
         external_id = _digits(5)