feat: add public image read boundary

apps/api/tests/application/public-image-service.test.js

@@ -0,0 +1,44 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { createPublicImageService } from '../../src/modules/inventory/services/public-image-service.js';
+
+test('returns public image URLs without exposing storage keys', async () => {
+  const service = createPublicImageService({
+    inventoryImageRepository: {
+      async listPublicByInventoryItemId(id) {
+        assert.equal(id, 'inventory-1');
+        return [{ id: 'image-1', altText: 'Front of card', sortOrder: 0 }];
+      },
+    },
+    imageStorage: { async get() { return Buffer.from('unused'); } },
+  });
+
+  assert.deepEqual(await service.listForInventoryItem('inventory-1'), [{
+    id: 'image-1',
+    altText: 'Front of card',
+    sortOrder: 0,
+    url: '/api/v1/public/images/image-1',
+  }]);
+});
+
+test('loads only repository-approved public image content', async () => {
+  const service = createPublicImageService({
+    inventoryImageRepository: {
+      async findPublicById(id) {
+        assert.equal(id, 'image-1');
+        return { id, storageKey: 'inventory/image.webp', mimeType: 'image/webp' };
+      },
+    },
+    imageStorage: {
+      async get(key) {
+        assert.equal(key, 'inventory/image.webp');
+        return Buffer.from('image-bytes');
+      },
+    },
+  });
+
+  const result = await service.getContent('image-1');
+  assert.deepEqual(result.data, Buffer.from('image-bytes'));
+  assert.equal(result.storageKey, 'inventory/image.webp');
+});

apps/api/tests/http/public-image-routes.test.js

@@ -0,0 +1,47 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { buildApp } from '../../src/app/build-app.js';
+
+test('serves public image bytes with the stored safe MIME type', async (testContext) => {
+  const app = buildApp({
+    publicImageService: {
+      async getContent(id) {
+        assert.equal(id, 'image-1');
+        return { mimeType: 'image/webp', data: Buffer.from('webp-bytes') };
+      },
+    },
+  });
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'GET',
+    url: '/api/v1/public/images/image-1',
+  });
+
+  assert.equal(response.statusCode, 200);
+  assert.equal(response.headers['content-type'], 'image/webp');
+  assert.equal(response.rawPayload.toString(), 'webp-bytes');
+});
+
+test('does not expose hidden image errors as internal failures', async (testContext) => {
+  const app = buildApp({
+    publicImageService: {
+      async getContent() {
+        const error = new Error('Image was not found.');
+        error.code = 'IMAGE_NOT_FOUND';
+        error.statusCode = 404;
+        throw error;
+      },
+    },
+  });
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'GET',
+    url: '/api/v1/public/images/hidden-image',
+  });
+
+  assert.equal(response.statusCode, 404);
+  assert.equal(response.json().error.code, 'IMAGE_NOT_FOUND');
+});