def METHOD_NAME(self) -> None:
    self.login("hamlet")
    fp = StringIO("zulip!")
    fp.name = "zulip.jpeg"
    result = self.client_post("/json/user_uploads", {"file": fp})
    self.assert_json_success(result)
    json = orjson.loads(result.content)
    url = json["uri"]
    with ratelimit_rule(86400, 1000, domain="spectator_attachment_access_by_file"):
        # Deny file access for non-web-public stream
        self.subscribe(self.example_user("hamlet"), "Denmark")
        host = self.example_user("hamlet").realm.host
        body = f"First message ...[zulip.txt](http://{host}" + url + ")"
        self.send_stream_message(self.example_user("hamlet"), "Denmark", body, "test")
        self.logout()
        response = self.client_get("/thumbnail", {"url": url[1:], "size": "full"})
        self.assertEqual(response.status_code, 403)
        # Allow file access for web-public stream
        self.login("hamlet")
        self.make_stream("web-public-stream", is_web_public=True)
        self.subscribe(self.example_user("hamlet"), "web-public-stream")
        body = f"First message ...[zulip.txt](http://{host}" + url + ")"
        self.send_stream_message(self.example_user("hamlet"), "web-public-stream", body, "test")
        self.logout()
        response = self.client_get("/thumbnail", {"url": url[1:], "size": "full"})
        self.assertEqual(response.status_code, 302)
    # Deny file access since rate limited
    with ratelimit_rule(86400, 0, domain="spectator_attachment_access_by_file"):
        response = self.client_get("/thumbnail", {"url": url[1:], "size": "full"})
        self.assertEqual(response.status_code, 403)
    # Deny random file access
    response = self.client_get(
        "/thumbnail",
        {
            "url": "user_uploads/2/71/QYB7LA-ULMYEad-QfLMxmI2e/zulip-non-existent.txt",
            "size": "full",
        },
    )
    self.assertEqual(response.status_code, 403)