fix(security): authorize site uploads and harden tokens, media and request identity

src/actions/save-logo.ts

@@ -3,37 +3,32 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { revalidatePath } from "next/cache";
+import { requirePermission } from "@/lib/admin/guard";
 import { db, WebsiteSetting } from "@/lib/db";
+import { validateSiteImageUpload } from "@/lib/images/site-image-upload";
+import { logger } from "@/lib/logger";
 import { resolveMediaPath } from "@/lib/media-storage";
+import { PERMS } from "@/lib/permissions";
 import { siteSettings } from "@/lib/services/site-settings";
 
-const MEDIA_DIR = resolveMediaPath("logo");
-
 export async function saveLogo(
 	formData: FormData,
 ): Promise<{ success: boolean; url?: string; error?: string }> {
+	await requirePermission(PERMS.SETTINGS_EDIT);
 	try {
-		const file = formData.get("file") as File | null;
-		if (!file) return { success: false, error: "No file provided" };
-
-		const ext =
-			file.type === "image/png"
-				? "png"
-				: file.type === "image/gif"
-					? "gif"
-					: file.type === "image/jpeg"
-						? "jpg"
-						: file.type === "image/webp"
-							? "webp"
-							: "png";
+		const upload = await validateSiteImageUpload(
+			formData instanceof FormData ? formData.get("file") : null,
+		);
+		if (!upload.success) return upload;
+		const ext = upload.extension;
 		const filename = `logo-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${ext}`;
-		const baseDir = MEDIA_DIR;
+		const baseDir = resolveMediaPath("logo");
 		const filePath = path.resolve(baseDir, filename);
 		if (!filePath.startsWith(baseDir + path.sep)) {
 			return { success: false, error: "Invalid path" };
 		}
 
-		const buffer = Buffer.from(await file.arrayBuffer());
+		const buffer = upload.bytes;
 		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await mkdir(baseDir, { recursive: true });
 		// eslint-disable-next-line security/detect-non-literal-fs-filename
@@ -50,10 +45,8 @@ export async function saveLogo(
 		revalidatePath("/", "layout");
 
 		return { success: true, url };
-	} catch (e) {
-		return {
-			success: false,
-			error: e instanceof Error ? e.message : "Unknown error",
-		};
+	} catch {
+		logger.error("Site logo update failed", { module: "site-images" });
+		return { success: false, error: "Could not update site logo" };
 	}
 }