fix(security): remediate telecom compliance findings

backend/tests/test_upload_security.py

@@ -0,0 +1,49 @@
+from fastapi import HTTPException
+
+from app.api.upload import build_object_key, is_owned_upload_key, validate_image_upload
+from app.config import settings, validate_security_settings
+
+
+USER_ID = "a2d4447f-7b67-4304-ad9a-953007e75ef2"
+
+
+def test_build_object_key_is_scoped_to_the_authenticated_user():
+    object_key = build_object_key(USER_ID, "jpg")
+
+    assert is_owned_upload_key(object_key, USER_ID)
+    assert not is_owned_upload_key(object_key, "cf610b28-51a7-423d-a55a-730e193c9971")
+
+
+def test_upload_rejects_non_image_content_type():
+    try:
+        validate_image_upload("payload.exe", "application/octet-stream")
+    except HTTPException as exc:
+        assert exc.status_code == 400
+    else:
+        raise AssertionError("non-image uploads must be rejected")
+
+
+def test_upload_rejects_an_invalid_filename_extension():
+    try:
+        validate_image_upload("payload.txt", "image/jpeg")
+    except HTTPException as exc:
+        assert exc.status_code == 400
+    else:
+        raise AssertionError("invalid extensions must be rejected")
+
+
+def test_production_rejects_placeholder_database_configuration(monkeypatch):
+    monkeypatch.setattr(settings, "ENVIRONMENT", "production")
+    monkeypatch.setattr(settings, "SECRET_KEY", "a" * 32)
+    monkeypatch.setattr(settings, "DATABASE_URL", "postgresql+asyncpg://qiji_app:invalid@localhost:5432/qiji")
+    monkeypatch.setattr(settings, "MINIO_ENDPOINT", "minio.example.test:9000")
+    monkeypatch.setattr(settings, "MINIO_ACCESS_KEY", "qiji-app")
+    monkeypatch.setattr(settings, "MINIO_SECRET_KEY", "a-secure-minio-secret")
+    monkeypatch.setattr(settings, "MINIO_SECURE", True)
+
+    try:
+        validate_security_settings()
+    except RuntimeError as exc:
+        assert "DATABASE_URL" in str(exc)
+    else:
+        raise AssertionError("production configuration must reject placeholders")