Corregge validazione upload copertina e generazione slate al go-live.

Rifiuta file troppo grandi o non-immagine via Marcel prima di attach, e genera la slate in sync anche quando cover_image esiste ma cover_slate non è ancora pronta.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/controllers/api/v1/base_controller.rb

@@ -2,6 +2,7 @@ module Api
   module V1
     class BaseController < ApplicationController
       rescue_from Teams::EntitlementError, with: :render_entitlement_error
+      rescue_from BrandingAttachments::CoverUploadError, with: :render_cover_upload_error
       rescue_from Youtube::BroadcastService::Error, with: :render_youtube_error
 
       private
@@ -20,6 +21,10 @@ module Api
           billing_url: error.billing_url
         }, status: :forbidden
       end
+
+      def render_cover_upload_error(error)
+        render json: { error: error.message, error_code: "cover_upload_invalid" }, status: :unprocessable_entity
+      end
     end
   end
 end

backend/app/controllers/concerns/branding_attachments.rb

@@ -20,10 +20,32 @@ module BrandingAttachments
     return if file.blank?
 
     entitlements.assert_can_upload_cover!
+    validate_cover_file!(file)
     record.cover_slate.purge if record.cover_slate.attached?
     record.cover_image.attach(file)
   end
 
+  def validate_cover_file!(file)
+    allowed_types = Coverable::COVER_IMAGE_TYPES
+
+    # Rileva MIME dal contenuto (magic bytes) ignorando il declared_type del client.
+    io = file.respond_to?(:tempfile) ? file.tempfile : file
+    io.rewind if io.respond_to?(:rewind)
+    detected = Marcel::MimeType.for(io, name: file.respond_to?(:original_filename) ? file.original_filename : nil)
+    io.rewind if io.respond_to?(:rewind)
+
+    unless detected.in?(allowed_types)
+      raise CoverUploadError, I18n.t("coverable.errors.invalid_type")
+    end
+
+    byte_size = file.respond_to?(:size) ? file.size : File.size(file.path)
+    if byte_size > Coverable::MAX_COVER_BYTES
+      raise CoverUploadError, I18n.t("coverable.errors.too_large")
+    end
+  end
+
+  class CoverUploadError < StandardError; end
+
   def enqueue_cover_slate_generation(record)
     GenerateCoverSlateJob.enqueue_for(record) if record.cover_image.attached?
   end

backend/app/controllers/public/clubs_controller.rb

@@ -80,7 +80,7 @@ module Public
       @entitlements = @club.teams.first&.entitlements
       flash.now[:alert] = e.record.errors.full_messages.join(", ")
       render :edit, status: :unprocessable_entity
-    rescue Teams::EntitlementError => e
+    rescue Teams::EntitlementError, BrandingAttachments::CoverUploadError => e
       @entitlements = @club.teams.first&.entitlements
       flash.now[:alert] = e.message
       render :edit, status: :unprocessable_entity

backend/app/controllers/public/teams_controller.rb

@@ -59,7 +59,7 @@ module Public
       @entitlements = @team.entitlements
       flash.now[:alert] = e.record.errors.full_messages.join(", ")
       render :edit, status: :unprocessable_entity
-    rescue Teams::EntitlementError => e
+    rescue Teams::EntitlementError, BrandingAttachments::CoverUploadError => e
       @club = @team.club
       @entitlements = @team.entitlements
       flash.now[:alert] = e.message