fragginwagon/pokemon-inventory
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: validate inventory image metadata

Browse Source 
Centralize supported MIME type, 10 MiB file-size, and 10,000-pixel dimension limits in the inventory image service boundary. Add domain coverage and update image/status documentation. Verification: npm test passed 64 tests and integration passed 14 tests. No build script is configured.
This commit is contained in:
fragginwagon
2026-09-08 17:35:59 -04:00
parent 31f11f6d56
commit 5a041c8a5c
5 changed files with 71 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/IMAGES.md
+5
View File
@@ -53,6 +53,11 @@ Validate:
- image dimensions
- configured image count
The metadata service currently enforces JPEG, PNG, and WebP MIME types, a
10 MiB default file-size limit, and a 10,000-pixel maximum width and height.
Binary signature checks and multipart upload validation remain part of the
upload transport slice.
Generate:
- thumbnail
- medium
docs/IMPLEMENTATION-STATUS.md
+3 -2
View File
@@ -91,6 +91,7 @@ docker context use orbstack
- Listing reads are seller-scoped and return only admin listing DTO fields.
- Item-owned image metadata can be added through a seller-scoped, CSRF-protected admin route; publication uses the persisted image count.
- `ImageStorage` and a traversal-safe local filesystem adapter are implemented; upload transport, signature validation, and derivative processing remain.
- Image metadata limits are enforced in the service boundary: supported MIME types, 10 MiB default file size, and 10,000-pixel maximum dimensions.
### Verified Baseline
@@ -101,13 +102,13 @@ docker context use orbstack
| HTTP | Product and inventory creation, validation, authentication/recovery, CSRF, rate limiting, and session management |
| Integration | PostgreSQL catalog/session/audit/password recovery persistence and Redis-shared login throttling |
Latest result: `npm test` passed 62 tests; `npm run test:integration` passed 14 tests against OrbStack PostgreSQL and Redis.
Latest result: `npm test` passed 64 tests; `npm run test:integration` passed 14 tests against OrbStack PostgreSQL and Redis.
## Next Milestone
Complete the inventory/listing integrity boundary before starting pricing and acquisition.
1. Add upload transport, MIME/signature/size validation, and processing/derivative lifecycle for persisted image metadata.
1. Add multipart upload transport, binary signature validation, and processing/derivative lifecycle for persisted image metadata.
2. Begin acquisition and pricing foundations after the listing/image boundary is complete.
Acceptance criteria: listing reads and lifecycle writes preserve seller ownership, CSRF, inventory status, and publication prerequisites.