apps/backend/src/modules/files/application/file-policy.service.tsTypeScript
import { Injectable } from '@nestjs/common';
import { DomainConflictError } from '../../../common/errors/domain-conflict.error';
const POLICIES:Record<string,{maxBytes:number;mime:string[]}>={
recipe_media:{maxBytes:15*1024*1024,mime:['image/jpeg','image/png','image/webp']},
training_media:{maxBytes:250*1024*1024,mime:['image/jpeg','image/png','image/webp','video/mp4','application/pdf']},
task_evidence:{maxBytes:20*1024*1024,mime:['image/jpeg','image/png','image/webp','application/pdf']},
incident_evidence:{maxBytes:20*1024*1024,mime:['image/jpeg','image/png','image/webp','application/pdf']},
safety_evidence:{maxBytes:20*1024*1024,mime:['image/jpeg','image/png','image/webp','application/pdf']},
employee_document:{maxBytes:20*1024*1024,mime:['application/pdf','image/jpeg','image/png']},
supplier_document:{maxBytes:30*1024*1024,mime:['application/pdf','image/jpeg','image/png']},
invoice_document:{maxBytes:30*1024*1024,mime:['application/pdf','image/jpeg','image/png']},
import_source:{maxBytes:25*1024*1024,mime:['text/csv','application/vnd.openxmlformats-officedocument.spreadsheetml.sheet']},
export_result:{maxBytes:100*1024*1024,mime:['text/csv','application/vnd.openxmlformats-officedocument.spreadsheetml.sheet','application/pdf']},
other:{maxBytes:10*1024*1024,mime:['application/pdf','image/jpeg','image/png','image/webp','text/plain']},
};
@Injectable()
export class FilePolicyService {
validate(input:{purpose:string;sizeBytes:number;mimeType:string;fileName:string}) {
const policy=POLICIES[input.purpose];
if(!policy) throw new DomainConflictError('files.purpose_invalid');
if(input.sizeBytes<0 || input.sizeBytes>policy.maxBytes) {
throw new DomainConflictError('files.size_invalid',{maxBytes:policy.maxBytes});
}
if(!policy.mime.includes(input.mimeType)) {
throw new DomainConflictError('files.mime_invalid',{mimeType:input.mimeType});
}
const lower=input.fileName.toLowerCase();
if(lower.endsWith('.html') || lower.endsWith('.svg') || lower.endsWith('.js') ||
lower.endsWith('.exe') || lower.endsWith('.sh')) {
throw new DomainConflictError('files.extension_forbidden');
}
}
}