Validate media type on all get_single_layer() return paths

Address review feedback: the single-layer and artifact_type paths
were returning layers without checking if they have a flashable
media type (application/vnd.automotive.disk.*). Now all paths
use a shared is_flashable closure for consistent validation.

Also add unit tests for: artifact_type selection, single non-disk
layer rejection, single flashable layer acceptance, and no-match
error.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

src/fls/oci/manifest.rs

@@ -142,23 +142,33 @@ impl Manifest {
                     return Err("Manifest has no layers".to_string());
                 }
 
+                let is_flashable =
+                    |l: &&Descriptor| l.media_type.starts_with("application/vnd.automotive.disk");
+
                 if m.layers.len() == 1 {
-                    return Ok(&m.layers[0]);
+                    let layer = &m.layers[0];
+                    if is_flashable(&&layer) {
+                        return Ok(layer);
+                    }
+                    return Err(format!(
+                        "Single layer has non-flashable media type: {}",
+                        layer.media_type
+                    ));
                 }
 
-                // If artifactType is set, find the layer matching it
+                // If artifactType is set, find the layer matching it (must also be flashable)
                 if let Some(ref artifact_type) = m.artifact_type {
-                    if let Some(layer) = m.layers.iter().find(|l| l.media_type == *artifact_type) {
+                    if let Some(layer) = m
+                        .layers
+                        .iter()
+                        .find(|l| l.media_type == *artifact_type && is_flashable(l))
+                    {
                         return Ok(layer);
                     }
                 }
 
                 // Fall back to the first disk image layer
-                if let Some(layer) = m
-                    .layers
-                    .iter()
-                    .find(|l| l.media_type.starts_with("application/vnd.automotive.disk"))
-                {
+                if let Some(layer) = m.layers.iter().find(|l| is_flashable(l)) {
                     return Ok(layer);
                 }
 
@@ -279,6 +289,113 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_single_flashable_layer() {
+        let json = r#"{
+            "schemaVersion": 2,
+            "config": {
+                "mediaType": "application/vnd.oci.image.config.v1+json",
+                "digest": "sha256:config123",
+                "size": 100
+            },
+            "layers": [
+                {
+                    "mediaType": "application/vnd.automotive.disk.raw",
+                    "digest": "sha256:disk123",
+                    "size": 9999
+                }
+            ]
+        }"#;
+        let manifest = Manifest::parse(json.as_bytes(), None).unwrap();
+        let layer = manifest.get_single_layer().unwrap();
+        assert_eq!(layer.digest, "sha256:disk123");
+    }
+
+    #[test]
+    fn test_single_non_disk_layer_rejected() {
+        let json = r#"{
+            "schemaVersion": 2,
+            "config": {
+                "mediaType": "application/vnd.oci.image.config.v1+json",
+                "digest": "sha256:config123",
+                "size": 100
+            },
+            "layers": [
+                {
+                    "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+                    "digest": "sha256:layer123",
+                    "size": 5678
+                }
+            ]
+        }"#;
+        let manifest = Manifest::parse(json.as_bytes(), None).unwrap();
+        let err = manifest.get_single_layer().unwrap_err();
+        assert!(
+            err.contains("non-flashable"),
+            "Expected non-flashable error, got: {}",
+            err
+        );
+    }
+
+    #[test]
+    fn test_artifact_type_selection() {
+        let json = r#"{
+            "schemaVersion": 2,
+            "artifactType": "application/vnd.automotive.disk.raw",
+            "config": {
+                "mediaType": "application/vnd.oci.image.config.v1+json",
+                "digest": "sha256:config123",
+                "size": 100
+            },
+            "layers": [
+                {
+                    "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+                    "digest": "sha256:layer1",
+                    "size": 1000
+                },
+                {
+                    "mediaType": "application/vnd.automotive.disk.raw",
+                    "digest": "sha256:disk1",
+                    "size": 9999
+                }
+            ]
+        }"#;
+        let manifest = Manifest::parse(json.as_bytes(), None).unwrap();
+        let layer = manifest.get_single_layer().unwrap();
+        assert_eq!(layer.digest, "sha256:disk1");
+    }
+
+    #[test]
+    fn test_no_flashable_layer_error() {
+        let json = r#"{
+            "schemaVersion": 2,
+            "config": {
+                "mediaType": "application/vnd.oci.image.config.v1+json",
+                "digest": "sha256:config123",
+                "size": 100
+            },
+            "layers": [
+                {
+                    "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+                    "digest": "sha256:layer1",
+                    "size": 1000
+                },
+                {
+                    "mediaType": "application/vnd.oci.image.layer.v1.tar+zstd",
+                    "digest": "sha256:layer2",
+                    "size": 2000
+                }
+            ]
+        }"#;
+        let manifest = Manifest::parse(json.as_bytes(), None).unwrap();
+        let err = manifest.get_single_layer().unwrap_err();
+        assert!(
+            err.contains("No disk image layer found"),
+            "Expected no-match error, got: {}",
+            err
+        );
+    }
+
     #[test]
     fn test_parse_index() {
         let json = r#"{