test/uploadMiddleware.test.js

const test = require('node:test');
const assert = require('node:assert/strict');
const path = require('path');

test('getFileKindChecker rejects svg mime type', () => {
  const IMAGE_EXTENSIONS = new Set(['jpg', 'jpeg', 'png', 'webp']);
  const IMAGE_MIME_TYPES = new Set(['image/jpeg', 'image/jpg', 'image/png', 'image/x-png', 'image/webp']);

  const isImageAllowed = (file) => {
    const ext = path.extname(file.originalname || '').toLowerCase().replace('.', '');
    const mime = String(file.mimetype || '').toLowerCase();
    return IMAGE_EXTENSIONS.has(ext) && IMAGE_MIME_TYPES.has(mime);
  };

  assert.equal(isImageAllowed({ originalname: 'evil.svg', mimetype: 'image/svg+xml' }), false, 'SVG must be rejected');
  assert.equal(isImageAllowed({ originalname: 'photo.jpg', mimetype: 'image/jpeg' }), true, 'JPEG must be allowed');
  assert.equal(isImageAllowed({ originalname: 'photo.png', mimetype: 'image/png' }), true, 'PNG must be allowed');
});

test('createUpload is a function that returns multer middleware', () => {
  const createUpload = require('../middleware/uploadMiddleware');
  assert.equal(typeof createUpload, 'function', 'createUpload must be a function');
  const upload = createUpload({ kind: 'image' });
  assert.equal(typeof upload.single, 'function', 'returned object must have .single method');
});