Check Uploads

Right now the shop stores any file of any size. Someone uploads page.html, a web page with a script in it, and the photo route serves it as text/html from your shop's own address: the browser runs the script as if your shop had written it. Someone else uploads a huge video, and the database fills up. So an upload checks rules before it stores anything.

A rule can be an array of allowed values, kept in a constant at the top of the file: .includes(value) is true when the value is in the array, and ! in front refuses everything else. For example, on another value:

const CURRENCIES = ["USD", "EUR"];

app.get("/prices", (req, res) => {
  const currency = req.query.currency;
  if (!CURRENCIES.includes(currency)) {
    return res.status(400).json({ error: "Unknown currency" });
  }
  ...
});

Find a file's type from its name with mime.lookup, the same way the GET photo route does when it serves it; a name with no extension gives false. Two statuses say what's wrong: 415 Unsupported Media Type ("I don't take this kind of file") and 413 Content Too Large. Exactly 1000 bytes is still fine.

POST /products/1/photo  (photo: mug.png, 16 bytes)  →  201  {"filename": "mug.png", "product_id": 1, "size": 16}
POST /products/1/photo  (photo: page.html)  →  415  {"error": "Only PNG and JPEG photos"}
POST /products/1/photo  (photo: mug, no extension)  →  415  {"error": "Only PNG and JPEG photos"}
POST /products/3/photo  (photo: lamp.jpg, 1001 bytes)  →  413  {"error": "The photo is larger than 1000 bytes"}
POST /products/3/photo  (photo: lamp.jpg, 1000 bytes)  →  201  {"filename": "lamp.jpg", "product_id": 3, "size": 1000}
POST /products/5/photo  (photo: Plant.JPG, 18 bytes)  →  201  {"filename": "Plant.JPG", "product_id": 5, "size": 18}
GET /products/1/photo  →  200  (image/png, 16 bytes)

Your task: add the constants PHOTO_TYPES ("image/png" and "image/jpeg") and MAX_PHOTO_BYTES (1000), then make the upload route answer 415 for any other type and 413 for a file over 1000 bytes, before it stores anything.

Assignment
Follow the Coding Tutorial to add the two upload rules.

Hint
Check the type right after the check that a file arrived, and the size right after taking its bytes. Use > for the size, not >=: a file of exactly 1000 bytes is allowed.