Implement Phase 2 asset storage pipeline

server/test/assets-multipart.test.js

@@ -0,0 +1,35 @@
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const {
+  mapMulterError,
+  safeOriginalFilename,
+} = require("../src/assets/multipart");
+
+test("original filename metadata keeps a safe leaf without path traversal", () => {
+  assert.equal(safeOriginalFilename("../../Sunday/welcome.png"), "welcome.png");
+  assert.equal(safeOriginalFilename("..\\..\\Sunday\\welcome.png"), "welcome.png");
+  assert.equal(safeOriginalFilename("  welcome sign.png  "), "  welcome sign.png  ");
+});
+
+test("original filename metadata removes controls and remains bounded", () => {
+  assert.equal(safeOriginalFilename("wel\u0000come\n.png"), "welcome.png");
+  assert.equal([...safeOriginalFilename(`${"a".repeat(300)}.png`)].length, 255);
+  assert.throws(
+    () => safeOriginalFilename(" \u0000\n "),
+    (error) => error.code === "INVALID_ORIGINAL_FILENAME",
+  );
+});
+
+test("temporary-storage failures are server errors, not invalid client uploads", () => {
+  const storageFailure = mapMulterError(
+    Object.assign(new Error("disk full at a private path"), { code: "ENOSPC" }),
+    {},
+  );
+  assert.equal(storageFailure.code, "UPLOAD_TEMP_STORAGE_UNAVAILABLE");
+  assert.equal(storageFailure.statusCode, 503);
+  assert.doesNotMatch(storageFailure.message, /private path/);
+
+  const malformed = mapMulterError(new Error("Unexpected end of form"), {});
+  assert.equal(malformed.code, "INVALID_MULTIPART_UPLOAD");
+  assert.equal(malformed.statusCode, 400);
+});