Check Uploads

Right now the shop stores any file of any size. Someone uploads page.html, a web page with a script in it, and the photo MapGet route serves it as text/html from your shop's own address: the browser runs the script as if your shop had written it. Someone else uploads a huge video, and the database fills up. So an upload checks rules before it stores anything.

A rule can be a list of allowed values, kept in a variable at the top of the file: ! in front of .Contains(…) refuses everything else. For example, on another value:

var CURRENCIES = new List<string> { "USD", "EUR" };

app.MapGet("/prices", (string? currency) => {
    if (!CURRENCIES.Contains(currency)) {
        return Results.Json(new { error = "Unknown currency" }, statusCode: 400);
    }
    ...
});

Find a file's type from its name with new FileExtensionContentTypeProvider().TryGetContentType(name, out var contentType), the same way the photo MapGet route does when it serves it; a name with no extension leaves contentType as null. Two statuses say what's wrong: 415 Unsupported Media Type ("I don't take this kind of file") and 413 Content Too Large. Exactly 1000 bytes is still fine.

POST /products/1/photo  (photo: mug.png, 16 bytes)  →  201  {"filename": "mug.png", "product_id": 1, "size": 16}
POST /products/1/photo  (photo: page.html)  →  415  {"error": "Only PNG and JPEG photos"}
POST /products/1/photo  (photo: mug, no extension)  →  415  {"error": "Only PNG and JPEG photos"}
POST /products/3/photo  (photo: lamp.jpg, 1001 bytes)  →  413  {"error": "The photo is larger than 1000 bytes"}
POST /products/3/photo  (photo: lamp.jpg, 1000 bytes)  →  201  {"filename": "lamp.jpg", "product_id": 3, "size": 1000}
POST /products/5/photo  (photo: Plant.JPG, 18 bytes)  →  201  {"filename": "Plant.JPG", "product_id": 5, "size": 18}
GET /products/1/photo  →  200  (image/png, 16 bytes)

Your task: add the variables PHOTO_TYPES ("image/png" and "image/jpeg") and MAX_PHOTO_BYTES (1000), then make the upload route answer 415 for any other type and 413 for a file over 1000 bytes, before it stores anything.

Assignment
Follow the Coding Tutorial to add the two upload rules.

Hint
Check the type right after the photo == null check, and the size right after the ReadExactly line. Use > for the size, not >=: a file of exactly 1000 bytes is allowed.