Preserve 400 classification for malformed /api/upload bodies

src/app/api/upload/route.ts

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { env } from "@/lib/env";
-import { assertAllowedFile, assertFileContentSignature, jsonError } from "@/lib/http";
+import { assertAllowedFile, assertFileContentSignature, jsonError, PublicApiError } from "@/lib/http";
 import { logger } from "@/lib/logger";
 import { writeAuditLog } from "@/lib/audit";
 import { planDocumentName } from "@/lib/document-naming";
@@ -28,7 +28,13 @@ export async function POST(request: Request) {
  try {
  supabase = createAdminClient();
  const user = await requireAuthenticatedUser(request, supabase);
- const formData = await request.formData();
+ const formData = await request.formData().catch((cause) => {
+ throw new PublicApiError("Invalid upload form data.", 400, {
+ code: "invalid_form_data",
+ causeName: cause instanceof Error ? cause.name : null,
+ causeMessage: cause instanceof Error ? cause.message : null,
+ });
+ });
  const file = formData.get("file");
  if (!(file instanceof File)) {
  return NextResponse.json({ error: "Missing file field." }, { status: 400 });
@@ -174,6 +180,6 @@ export async function POST(request: Request) {
  return unauthorizedResponse();
  }
 
- return jsonError(error, 400);
+ return jsonError(error);
  }
 }

tests/api-validation-contract.test.ts

@@ -386,6 +386,46 @@ describe("API validation contracts", () => {
  expect(client.from).not.toHaveBeenCalled();
  });
 
+ it("rejects non-form upload content before storage upload or database writes", async () => {
+ const client = createSupabaseMock();
+ mockRuntime(client);
+ const { POST } = await import("../src/app/api/upload/route");
+
+ const response = await POST(
+ authenticatedRequest("/api/upload", {
+ method: "POST",
+ headers: { "content-type": "application/json" },
+ body: JSON.stringify({ file: "nope" }),
+ }),
+ );
+ const body = await payload(response);
+
+ expect(response.status).toBe(400);
+ expect(body).toEqual({ error: "Invalid upload form data." });
+ expect(client.storageMocks.upload).not.toHaveBeenCalled();
+ expect(client.from).not.toHaveBeenCalled();
+ });
+
+ it("rejects malformed multipart upload bodies before storage upload or database writes", async () => {
+ const client = createSupabaseMock();
+ mockRuntime(client);
+ const { POST } = await import("../src/app/api/upload/route");
+
+ const response = await POST(
+ authenticatedRequest("/api/upload", {
+ method: "POST",
+ headers: { "content-type": "multipart/form-data; boundary=broken" },
+ body: "--broken\r\nContent-Disposition: form-data; name=\"file\"; filename=\"guideline.pdf\"\r\n\r\n%PDF-1.7",
+ }),
+ );
+ const body = await payload(response);
+
+ expect(response.status).toBe(400);
+ expect(body).toEqual({ error: "Invalid upload form data." });
+ expect(client.storageMocks.upload).not.toHaveBeenCalled();
+ expect(client.from).not.toHaveBeenCalled();
+ });
+
  it("accepts valid document rename JSON through the shared body parser", async () => {
  const client = createSupabaseMock((call) => {
  if (call.table === "documents" && call.operation === "select" && call.maybeSingle) {

tests/private-access-routes.test.ts

@@ -1489,7 +1489,7 @@ describe("private document API access", () => {
  );
  const uploadPath = client.storageMocks.upload.mock.calls[0]?.[0] as string;
 
- expect(response.status).toBe(400);
+ expect(response.status).toBe(500);
  expect(client.storageMocks.remove).toHaveBeenCalledWith([uploadPath]);
  });
 
@@ -1516,7 +1516,7 @@ describe("private document API access", () => {
  );
  const uploadPath = client.storageMocks.upload.mock.calls[0]?.[0] as string;
 
- expect(response.status).toBe(400);
+ expect(response.status).toBe(500);
  expect(client.storageMocks.remove).toHaveBeenCalledWith([uploadPath]);
  });