feat: validate inventory image metadata

Centralize supported MIME type, 10 MiB file-size, and 10,000-pixel dimension limits in the inventory image service boundary. Add domain coverage and update image/status documentation. Verification: npm test passed 64 tests and integration passed 14 tests. No build script is configured.

apps/api/src/modules/inventory/domain/inventory-image.js

@@ -0,0 +1,31 @@
+import { createApplicationError } from '../../../shared/errors/application-error.js';
+
+const SUPPORTED_MIME_TYPES = new Set(['image/jpeg', 'image/png', 'image/webp']);
+const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
+const DEFAULT_MAX_DIMENSION = 10_000;
+
+export function validateInventoryImageMetadata(
+  image,
+  { maxFileSize = DEFAULT_MAX_FILE_SIZE, maxDimension = DEFAULT_MAX_DIMENSION } = {},
+) {
+  if (!SUPPORTED_MIME_TYPES.has(image.mimeType)) {
+    throw createApplicationError('IMAGE_MIME_TYPE_UNSUPPORTED', 'Image MIME type is not supported.', 400);
+  }
+
+  if (!Number.isInteger(image.fileSize) || image.fileSize <= 0 || image.fileSize > maxFileSize) {
+    throw createApplicationError('IMAGE_FILE_TOO_LARGE', 'Image file size is invalid or too large.', 400);
+  }
+
+  if (
+    !Number.isInteger(image.width) ||
+    !Number.isInteger(image.height) ||
+    image.width <= 0 ||
+    image.height <= 0 ||
+    image.width > maxDimension ||
+    image.height > maxDimension
+  ) {
+    throw createApplicationError('IMAGE_DIMENSIONS_INVALID', 'Image dimensions are invalid or too large.', 400);
+  }
+
+  return true;
+}

apps/api/src/modules/inventory/services/inventory-image-service.js

@@ -1,8 +1,10 @@
 import { createApplicationError } from '../../../shared/errors/application-error.js';
+import { validateInventoryImageMetadata } from '../domain/inventory-image.js';
 
 export function createInventoryImageService({ inventoryImageRepository }) {
   return {
     async create(input) {
+      validateInventoryImageMetadata(input);
       const image = await inventoryImageRepository.createForSeller(
         { ...input, processingStatus: 'PENDING' },
         input.sellerId,

apps/api/tests/domain/inventory-image.test.js

@@ -0,0 +1,30 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { validateInventoryImageMetadata } from '../../src/modules/inventory/domain/inventory-image.js';
+
+const validImage = {
+  mimeType: 'image/jpeg',
+  fileSize: 12000,
+  width: 1200,
+  height: 900,
+};
+
+test('accepts supported image metadata within configured limits', () => {
+  assert.equal(validateInventoryImageMetadata(validImage), true);
+});
+
+test('rejects unsupported MIME types, oversized files, and oversized dimensions', () => {
+  assert.throws(
+    () => validateInventoryImageMetadata({ ...validImage, mimeType: 'image/gif' }),
+    (error) => error.code === 'IMAGE_MIME_TYPE_UNSUPPORTED',
+  );
+  assert.throws(
+    () => validateInventoryImageMetadata({ ...validImage, fileSize: 11 * 1024 * 1024 }),
+    (error) => error.code === 'IMAGE_FILE_TOO_LARGE',
+  );
+  assert.throws(
+    () => validateInventoryImageMetadata({ ...validImage, width: 10001 }),
+    (error) => error.code === 'IMAGE_DIMENSIONS_INVALID',
+  );
+});