fix(article): reject cover uploads carrying more than one file

src/http/controllers/article.controller.ts

@@ -12,7 +12,7 @@ import type { LikeArticleUseCase } from "@core/use-cases/article/like-article";
 import type { UnlikeArticleUseCase } from "@core/use-cases/article/unlike-article";
 import type { SaveArticleBookmarkUseCase } from "@core/use-cases/article/save-article-bookmark";
 import type { RemoveArticleBookmarkUseCase } from "@core/use-cases/article/remove-article-bookmark";
-import { NoMediaProvidedError } from "@core/errors";
+import { MediaLimitExceededError, NoMediaProvidedError } from "@core/errors";
 import { ArticlePrismaMapper } from "@infrastructure/persistence/mappers/article-prisma.mapper";
 import type { CreateArticleBody } from "@typings/schemas/article/create-article.schema";
 import type { UpdateArticleBody } from "@typings/schemas/article/update-article.schema";
@@ -319,14 +319,27 @@ export class ArticleController {
             );
         }
 
-        const file = await request.file();
+        // Iterated rather than taking request.file(), which silently keeps the
+        // first part and discards the rest: a client that uploaded three
+        // images would get a 200 and no way to know which one was stored.
+        const parts = request.files();
+        const first = await parts.next();
 
-        if (!file) {
+        if (first.done) {
             throw new NoMediaProvidedError("No cover image was provided.");
         }
 
+        const file = first.value;
         const fileBuffer = await file.toBuffer();
 
+        // An article holds exactly one cover, so a second file is a request
+        // the API cannot honour. Checked before anything is stored.
+        if (!(await parts.next()).done) {
+            throw new MediaLimitExceededError(
+                "An article takes exactly one cover image.",
+            );
+        }
+
         const coverImageKey = await this.uploadArticleCoverUseCase.execute({
             userId: request.user.id,
             fileBuffer,

tests/e2e/article/upload-cover.test.ts

@@ -39,6 +39,34 @@ const MULTIPART_HEADERS = {
     "content-type": `multipart/form-data; boundary=${BOUNDARY}`,
 };
 
+/**
+ * Builds a multipart body carrying several files under the same field name.
+ */
+function multipartMany(count: number): Buffer {
+    const parts: Buffer[] = [];
+
+    for (let i = 0; i < count; i++) {
+        parts.push(
+            Buffer.from(
+                `--${BOUNDARY}
+` +
+                    `Content-Disposition: form-data; name="file"; filename="cover${i}.png"
+` +
+                    `Content-Type: image/png
+
+`,
+            ),
+            Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, i]),
+            Buffer.from("
+"),
+        );
+    }
+
+    parts.push(Buffer.from(`--${BOUNDARY}--
+`));
+    return Buffer.concat(parts);
+}
+
 beforeAll(async () => {
     await request({ method: "POST", url: "/auth/register", payload: user });
     const login = await request({
@@ -116,6 +144,34 @@ describe("POST /articles/cover", () => {
         expect(response.statusCode).toBe(415);
     });
 
+    it("should reject a request carrying more than one file", async () => {
+        // An article holds exactly one cover. Taking the first part and
+        // discarding the rest would answer 200 and leave the client with no
+        // way to know which image was stored.
+        const response = await authRequest(accessToken, {
+            method: "POST",
+            url: "/articles/cover",
+            headers: MULTIPART_HEADERS,
+            payload: multipartMany(3),
+        });
+
+        expect(response.statusCode).toBe(400);
+        expect(parseBody<ErrorEnvelope>(response).title).toBe(
+            "MediaLimitExceededError",
+        );
+    });
+
+    it("should reject even two files", async () => {
+        const response = await authRequest(accessToken, {
+            method: "POST",
+            url: "/articles/cover",
+            headers: MULTIPART_HEADERS,
+            payload: multipartMany(2),
+        });
+
+        expect(response.statusCode).toBe(400);
+    });
+
     it("should reject an empty file", async () => {
         const response = await authRequest(accessToken, {
             method: "POST",