feat: support attached images for all providers

server/modules/assets/tests/image-assets.service.test.ts

@@ -0,0 +1,46 @@
+import assert from 'node:assert/strict';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import {
+  buildStoredImageRecords,
+  isAllowedImageMimeType,
+  resolveImageAssetFile,
+} from '@/modules/assets/services/image-assets.service.js';
+
+const ASSETS_DIR = path.join(os.homedir(), '.cloudcli', 'assets');
+
+test('isAllowedImageMimeType accepts image formats and rejects the rest', () => {
+  assert.equal(isAllowedImageMimeType('image/png'), true);
+  assert.equal(isAllowedImageMimeType('image/svg+xml'), true);
+  assert.equal(isAllowedImageMimeType('application/pdf'), false);
+  assert.equal(isAllowedImageMimeType('text/html'), false);
+});
+
+test('buildStoredImageRecords returns absolute posix paths in the assets dir', () => {
+  const records = buildStoredImageRecords([
+    { originalname: 'shot.png', filename: '123-456-shot.png', size: 42, mimetype: 'image/png' },
+  ]);
+
+  assert.equal(records.length, 1);
+  assert.equal(records[0].name, 'shot.png');
+  assert.equal(records[0].size, 42);
+  assert.equal(records[0].mimeType, 'image/png');
+  assert.equal(records[0].path, `${ASSETS_DIR.replace(/\\/g, '/')}/123-456-shot.png`);
+});
+
+test('resolveImageAssetFile resolves plain filenames inside the assets dir', () => {
+  const resolved = resolveImageAssetFile('123-shot.png');
+  assert.equal(resolved, path.join(path.resolve(ASSETS_DIR), '123-shot.png'));
+});
+
+test('resolveImageAssetFile rejects traversal and separator attempts', () => {
+  assert.equal(resolveImageAssetFile(''), null);
+  assert.equal(resolveImageAssetFile('   '), null);
+  assert.equal(resolveImageAssetFile('../auth.db'), null);
+  assert.equal(resolveImageAssetFile('..'), null);
+  assert.equal(resolveImageAssetFile('sub/dir.png'), null);
+  assert.equal(resolveImageAssetFile('sub\\dir.png'), null);
+  assert.equal(resolveImageAssetFile('a..b/../c.png'), null);
+});