Validate screenshot MIME and filename metadata

apps/api/tests/test_api.py

@@ -118,7 +118,7 @@ def test_admin_can_start_and_list_official_import(monkeypatch) -> None:
 
 def test_pending_report_accepts_one_validated_screenshot(monkeypatch) -> None:
     created = client.post("/api/v1/catch-reports", json={"fish_slug": "pike", "waterbody_slug": "test-lake", "x": 91, "y": 92, "weight_g": 4200}).json()
-    monkeypatch.setattr("app.main.upload_screenshot", lambda raw: "reports/test.jpg" if raw == b"image-bytes" else "unexpected")
+    monkeypatch.setattr("app.main.upload_screenshot", lambda raw, **metadata: "reports/test.jpg" if raw == b"image-bytes" and metadata == {"filename": "catch.jpg", "content_type": "image/jpeg"} else "unexpected")
     response = client.post(f"/api/v1/catch-reports/{created['id']}/screenshot", files={"screenshot": ("catch.jpg", b"image-bytes", "image/jpeg")})
     assert response.status_code == 204
     duplicate = client.post(f"/api/v1/catch-reports/{created['id']}/screenshot", files={"screenshot": ("catch.jpg", b"image-bytes", "image/jpeg")})

apps/api/tests/test_storage.py

@@ -5,7 +5,7 @@ import io
 import pytest
 from PIL import Image
 
-from app.storage import ScreenshotError, prepare_image
+from app.storage import ScreenshotError, prepare_image, validate_upload_metadata
 
 
 def test_prepare_image_removes_metadata() -> None:
@@ -26,3 +26,14 @@ def test_prepare_image_removes_metadata() -> None:
 def test_prepare_image_rejects_non_image() -> None:
     with pytest.raises(ScreenshotError, match="valid image"):
         prepare_image(b"not an image")
+
+
+def test_upload_metadata_requires_matching_supported_mime_and_extension() -> None:
+    validate_upload_metadata("catch.jpeg", "image/jpeg")
+    validate_upload_metadata("catch.webp", "image/webp")
+    with pytest.raises(ScreenshotError, match="extension and MIME"):
+        validate_upload_metadata("catch.exe", "image/jpeg")
+    with pytest.raises(ScreenshotError, match="extension and MIME"):
+        validate_upload_metadata("catch.png", "image/jpeg")
+    with pytest.raises(ScreenshotError, match="extension and MIME"):
+        validate_upload_metadata("catch.jpg", "application/octet-stream")