fix(uploads): address review feedback — input validation, stream safety, tests

- Fix Readable.from(buffer) → Readable.from([buffer]) to avoid byte-by-byte iteration
- Add readable error handler for reliable Promise rejection on stream failures
- Add Buffer.isBuffer validation with clear AppError (422) for invalid inputs
- Add defensive Array.isArray check for kindConfig.formats
- Extract MIME_TO_EXT map to module-level constant
- Add tests for null/undefined buffer, non-Buffer input, and missing formats

Author: PierreBrisorgueil

lib/services/gridfs.js

@@ -75,7 +75,8 @@ const createFromBuffer = (buffer, filename, contentType, metadata = {}) => new P
   const id = new mongoose.Types.ObjectId();
   const uploadStream = bucket.openUploadStreamWithId(id, filename, { contentType, metadata });
 
-  const readable = Readable.from(buffer);
+  const readable = Readable.from([buffer]);
+  readable.on('error', reject);
   readable.pipe(
     uploadStream
       .on('error', reject)

modules/uploads/services/uploads.service.js

@@ -9,6 +9,14 @@ import multerService from '../../../lib/services/multer.js';
 import gridfs from '../../../lib/services/gridfs.js';
 import UploadRepository from '../repositories/uploads.repository.js';
 
+const MIME_TO_EXT = {
+  'image/jpeg': 'jpeg',
+  'image/jpg': 'jpg',
+  'image/png': 'png',
+  'image/gif': 'gif',
+  'application/pdf': 'pdf',
+};
+
 /**
  * @desc Function to ask repository to get an upload
  * @param {String} uploadName
@@ -67,9 +75,17 @@ const remove = async (upload) => {
  * @returns {Promise<Object>} The created upload document
  */
 const createFromBuffer = async (buffer, contentType, kind, metadata = {}) => {
+  if (!Buffer.isBuffer(buffer)) {
+    throw new AppError('Upload: buffer is required and must be a Buffer', { code: 'SERVICE_ERROR', status: 422 });
+  }
+
   const kindConfig = config.uploads?.[kind];
   if (!kindConfig) throw new AppError(`Upload: unknown kind "${kind}"`, { code: 'SERVICE_ERROR', status: 422 });
 
+  if (!Array.isArray(kindConfig.formats)) {
+    throw new AppError(`Upload: kind "${kind}" has no formats configured`, { code: 'SERVICE_ERROR', status: 500 });
+  }
+
   if (!kindConfig.formats.includes(contentType)) {
     throw new AppError(`Upload: content type "${contentType}" not allowed for kind "${kind}"`, { code: 'SERVICE_ERROR', status: 422 });
   }
@@ -78,7 +94,6 @@ const createFromBuffer = async (buffer, contentType, kind, metadata = {}) => {
     throw new AppError(`Upload: buffer size ${buffer.length} exceeds limit ${kindConfig.limits.fileSize}`, { code: 'SERVICE_ERROR', status: 422 });
   }
 
-  const MIME_TO_EXT = { 'image/jpeg': 'jpeg', 'image/jpg': 'jpg', 'image/png': 'png', 'image/gif': 'gif', 'application/pdf': 'pdf' };
   const ext = MIME_TO_EXT[contentType] || 'bin';
   const filename = `${crypto.randomBytes(32).toString('hex')}.${ext}`;
 

modules/uploads/tests/uploads.createFromBuffer.unit.tests.js

@@ -128,4 +128,34 @@ describe('Uploads createFromBuffer unit tests:', () => {
 
     expect(mockGridfs.createFromBuffer).not.toHaveBeenCalled();
   });
+
+  test('should throw error when buffer is null or undefined', async () => {
+    await expect(
+      UploadsService.createFromBuffer(null, 'image/jpeg', 'snapshot'),
+    ).rejects.toThrow(/buffer is required/);
+
+    await expect(
+      UploadsService.createFromBuffer(undefined, 'image/jpeg', 'snapshot'),
+    ).rejects.toThrow(/buffer is required/);
+
+    expect(mockGridfs.createFromBuffer).not.toHaveBeenCalled();
+  });
+
+  test('should throw error when buffer is not a Buffer', async () => {
+    await expect(
+      UploadsService.createFromBuffer('not a buffer', 'image/jpeg', 'snapshot'),
+    ).rejects.toThrow(/buffer is required/);
+
+    expect(mockGridfs.createFromBuffer).not.toHaveBeenCalled();
+  });
+
+  test('should throw error when kind has no formats configured', async () => {
+    mockConfig.uploads.broken = { kind: 'broken', limits: { fileSize: 1024 } };
+
+    await expect(
+      UploadsService.createFromBuffer(Buffer.alloc(10), 'image/jpeg', 'broken'),
+    ).rejects.toThrow(/no formats configured/);
+
+    expect(mockGridfs.createFromBuffer).not.toHaveBeenCalled();
+  });
 });