Corregge validazione upload copertina e generazione slate al go-live.

Rifiuta file troppo grandi o non-immagine via Marcel prima di attach, e genera la slate in sync anche quando cover_image esiste ma cover_slate non è ancora pronta.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/controllers/concerns/branding_attachments.rb

@@ -20,10 +20,32 @@ module BrandingAttachments
     return if file.blank?
 
     entitlements.assert_can_upload_cover!
+    validate_cover_file!(file)
     record.cover_slate.purge if record.cover_slate.attached?
     record.cover_image.attach(file)
   end
 
+  def validate_cover_file!(file)
+    allowed_types = Coverable::COVER_IMAGE_TYPES
+
+    # Rileva MIME dal contenuto (magic bytes) ignorando il declared_type del client.
+    io = file.respond_to?(:tempfile) ? file.tempfile : file
+    io.rewind if io.respond_to?(:rewind)
+    detected = Marcel::MimeType.for(io, name: file.respond_to?(:original_filename) ? file.original_filename : nil)
+    io.rewind if io.respond_to?(:rewind)
+
+    unless detected.in?(allowed_types)
+      raise CoverUploadError, I18n.t("coverable.errors.invalid_type")
+    end
+
+    byte_size = file.respond_to?(:size) ? file.size : File.size(file.path)
+    if byte_size > Coverable::MAX_COVER_BYTES
+      raise CoverUploadError, I18n.t("coverable.errors.too_large")
+    end
+  end
+
+  class CoverUploadError < StandardError; end
+
   def enqueue_cover_slate_generation(record)
     GenerateCoverSlateJob.enqueue_for(record) if record.cover_image.attached?
   end