fix(housekeeping): address task 14 review round 2

src/app/api/media/[...path]/route.test.ts

@@ -0,0 +1,34 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { GET } from "./route";
+
+vi.mock("node:fs", () => ({ existsSync: vi.fn() }));
+vi.mock("node:fs/promises", () => ({ readFile: vi.fn() }));
+vi.mock("@/lib/media-storage", () => ({
+	MEDIA_ROOT: "C:\\media",
+	resolveMediaPath: vi.fn(
+		(name: string) => `C:\\media\\${name.replaceAll("/", "\\")}`,
+	),
+}));
+
+describe("GET /api/media/[...path]", () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+		vi.mocked(existsSync).mockReturnValue(true);
+		vi.mocked(readFile).mockResolvedValue(Buffer.from([0, 0, 1, 0]));
+	});
+
+	it("serves a stored genuine ICO with the canonical MIME and nosniff", async () => {
+		const response = await GET(
+			new Request("http://localhost/api/media/favicon/site.ico"),
+			{
+				params: Promise.resolve({ path: ["favicon", "site.ico"] }),
+			},
+		);
+		expect(response.status).toBe(200);
+		expect(response.headers.get("content-type")).toBe("image/x-icon");
+		expect(response.headers.get("x-content-type-options")).toBe("nosniff");
+		expect(readFile).toHaveBeenCalledOnce();
+	});
+});

src/app/api/media/[...path]/route.ts

@@ -4,7 +4,16 @@ import path from "node:path";
 import { NextResponse } from "next/server";
 import { MEDIA_ROOT, resolveMediaPath } from "@/lib/media-storage";
 
-const ALLOWED_EXT = [".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".bmp"];
+const ALLOWED_EXT = [
+	".png",
+	".jpg",
+	".jpeg",
+	".gif",
+	".webp",
+	".svg",
+	".bmp",
+	".ico",
+];
 
 export async function GET(
 	_request: Request,
@@ -41,6 +50,7 @@ export async function GET(
 		".webp": "image/webp",
 		".svg": "image/svg+xml",
 		".bmp": "image/bmp",
+		".ico": "image/x-icon",
 	};
 
 	return new NextResponse(bytes, {