feat: protect feedback screenshots

2026-04-30 13:15:19 -04:00
parent cb6948aa14
commit 4873f39192
24 changed files with 1900 additions and 0 deletions
--- a/backend/src/Socialize.Api/Modules/Feedback/Handlers/AttachMyFeedbackScreenshot.cs
+++ b/backend/src/Socialize.Api/Modules/Feedback/Handlers/AttachMyFeedbackScreenshot.cs
@@ -0,0 +1,124 @@
+using FastEndpoints;
+using Microsoft.EntityFrameworkCore;
+using Socialize.Api.Data;
+using Socialize.Api.Infrastructure.BlobStorage.Contracts;
+using Socialize.Api.Infrastructure.Security;
+using Socialize.Api.Modules.Feedback.Contracts;
+using Socialize.Api.Modules.Feedback.Data;
+using Socialize.Api.Modules.Feedback.Services;
+
+namespace Socialize.Api.Modules.Feedback.Handlers;
+
+public record AttachMyFeedbackScreenshotRequest(IFormFile File);
+
+public class AttachMyFeedbackScreenshotRequestValidator
+    : Validator<AttachMyFeedbackScreenshotRequest>
+{
+    public AttachMyFeedbackScreenshotRequestValidator()
+    {
+        RuleFor(x => x.File).NotNull().NotEmpty();
+    }
+}
+
+public class AttachMyFeedbackScreenshotHandler(
+    AppDbContext dbContext,
+    IBlobStorage blobStorage)
+    : Endpoint<AttachMyFeedbackScreenshotRequest, FeedbackReportDto>
+{
+    public override void Configure()
+    {
+        Post("/api/my-feedback/{id}/screenshot");
+        Options(o => o.WithTags("Feedback"));
+        AllowFileUploads();
+    }
+
+    public override async Task HandleAsync(AttachMyFeedbackScreenshotRequest request, CancellationToken ct)
+    {
+        Guid id = Route<Guid>("id");
+        Guid reporterUserId = User.GetUserId();
+
+        FeedbackReport? report = await dbContext.FeedbackReports
+            .Include(candidate => candidate.Tags)
+            .Include(candidate => candidate.Screenshot)
+            .SingleOrDefaultAsync(
+                candidate => candidate.Id == id && candidate.ReporterUserId == reporterUserId,
+                ct);
+
+        if (report is null)
+        {
+            await SendNotFoundAsync(ct);
+            return;
+        }
+
+        if (report.Screenshot is not null)
+        {
+            AddError("A screenshot is already attached to this feedback report.");
+            await SendErrorsAsync(StatusCodes.Status409Conflict, ct);
+            return;
+        }
+
+        if (!FeedbackScreenshotRules.IsAllowedSize(request.File.Length))
+        {
+            AddError(
+                request => request.File,
+                $"The screenshot must be greater than 0 bytes and no larger than {FeedbackScreenshotRules.MaxScreenshotBytes} bytes.");
+            await SendErrorsAsync(StatusCodes.Status400BadRequest, ct);
+            return;
+        }
+
+        if (!FeedbackScreenshotRules.IsAllowedContentType(request.File.ContentType))
+        {
+            AddError(request => request.File, "The screenshot must be a PNG or JPEG image.");
+            await SendErrorsAsync(StatusCodes.Status400BadRequest, ct);
+            return;
+        }
+
+        Guid screenshotId = Guid.NewGuid();
+        string extension = FeedbackScreenshotRules.GetFileExtension(request.File.ContentType);
+        string blobName = $"{SubDirectoryNames.FeedbackScreenshots}/{report.Id}/{screenshotId}{extension}";
+
+        try
+        {
+            await blobStorage.UploadFileAsync(
+                ContainerNames.Feedback,
+                blobName,
+                request.File.OpenReadStream(),
+                request.File.ContentType,
+                ct);
+        }
+        catch (InvalidOperationException)
+        {
+            AddError(request => request.File, "The screenshot file is invalid or unsupported.");
+            await SendErrorsAsync(StatusCodes.Status400BadRequest, ct);
+            return;
+        }
+
+        DateTimeOffset now = DateTimeOffset.UtcNow;
+        report.Screenshot = new FeedbackScreenshot
+        {
+            Id = screenshotId,
+            FeedbackReportId = report.Id,
+            FileName = NormalizeFileName(request.File.FileName, extension),
+            ContentType = request.File.ContentType,
+            SizeBytes = request.File.Length,
+            BlobContainerName = ContainerNames.Feedback,
+            BlobName = blobName,
+            CreatedAt = now,
+        };
+        report.LastActivityAt = now;
+
+        await dbContext.SaveChangesAsync(ct);
+        await SendOkAsync(report.ToDto(), ct);
+    }
+
+    private static string NormalizeFileName(string? fileName, string extension)
+    {
+        string normalized = Path.GetFileName(fileName ?? string.Empty).Trim();
+        if (string.IsNullOrWhiteSpace(normalized))
+        {
+            return $"feedback-screenshot{extension}";
+        }
+
+        return normalized.Length > 256 ? normalized[..256] : normalized;
+    }
+}