fix(nextcloud): detect MIME type via magic bytes instead of trusting client header

Nextcloud app uploads sent application/octet-stream as Content-Type,
causing images to not be recognized. Now both WebDAV PUT and chunked
upload paths call refine_content_type() which detects via magic bytes,
then extension, then falls back to the client header. Also fixes
update_file() which previously hardcoded application/octet-stream.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/common/mime_detect.rs

@@ -9,10 +9,16 @@
 //! Performance: < 1µs for the `infer` check (reads only header bytes, no allocation).
 
 use std::path::Path;
+use tokio::io::AsyncReadExt;
 
 /// Maximum bytes to read for magic-byte detection.
 const MAGIC_BYTES_LEN: usize = 8192;
 
+/// Extract the filename component from a `/`-separated path.
+pub fn filename_from_path(path: &str) -> &str {
+    path.rsplit('/').next().unwrap_or(path)
+}
+
 /// Refine a claimed MIME type using magic bytes and filename extension.
 ///
 /// This is a synchronous function — the caller should already have the first
@@ -62,11 +68,12 @@ pub async fn refine_content_type_from_file(
         return claimed.to_string();
     }
 
-    // Read first bytes for magic detection
-    match tokio::fs::read(temp_path).await {
-        Ok(full) => {
-            let len = full.len().min(MAGIC_BYTES_LEN);
-            refine_content_type(&full[..len], filename, claimed)
+    // Read only the first bytes needed for magic detection (not the whole file).
+    match tokio::fs::File::open(temp_path).await {
+        Ok(mut file) => {
+            let mut buf = vec![0u8; MAGIC_BYTES_LEN];
+            let n = file.read(&mut buf).await.unwrap_or(0);
+            refine_content_type(&buf[..n], filename, claimed)
         }
         Err(e) => {
             tracing::warn!(
@@ -83,3 +90,123 @@ pub async fn refine_content_type_from_file(
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+
+    // ── refine_content_type (sync) ──────────────────────────────
+
+    #[test]
+    fn specific_claimed_type_is_trusted() {
+        let result = refine_content_type(b"garbage", "file.txt", "image/png");
+        assert_eq!(result, "image/png");
+    }
+
+    #[test]
+    fn octet_stream_triggers_magic_detection_png() {
+        // PNG magic bytes
+        let png = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR";
+        let result = refine_content_type(png, "noext", "application/octet-stream");
+        assert_eq!(result, "image/png");
+    }
+
+    #[test]
+    fn octet_stream_triggers_magic_detection_jpeg() {
+        let jpeg = b"\xff\xd8\xff\xe0\x00\x10JFIF";
+        let result = refine_content_type(jpeg, "noext", "application/octet-stream");
+        assert_eq!(result, "image/jpeg");
+    }
+
+    #[test]
+    fn binary_octet_stream_also_triggers_detection() {
+        let jpeg = b"\xff\xd8\xff\xe0\x00\x10JFIF";
+        let result = refine_content_type(jpeg, "noext", "binary/octet-stream");
+        assert_eq!(result, "image/jpeg");
+    }
+
+    #[test]
+    fn extension_fallback_when_no_magic_match() {
+        let result = refine_content_type(b"plain text", "style.css", "application/octet-stream");
+        assert_eq!(result, "text/css");
+    }
+
+    #[test]
+    fn falls_back_to_claimed_when_nothing_matches() {
+        let result =
+            refine_content_type(b"unknown stuff", "noext", "application/octet-stream");
+        assert_eq!(result, "application/octet-stream");
+    }
+
+    #[test]
+    fn empty_claimed_triggers_detection() {
+        let png = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR";
+        let result = refine_content_type(png, "photo.png", "");
+        assert_eq!(result, "image/png");
+    }
+
+    // ── refine_content_type_from_file (async) ───────────────────
+
+    #[tokio::test]
+    async fn from_file_detects_png() {
+        let mut tmp = tempfile::NamedTempFile::new().unwrap();
+        let png = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR";
+        tmp.write_all(png).unwrap();
+        tmp.flush().unwrap();
+
+        let result =
+            refine_content_type_from_file(tmp.path(), "photo", "application/octet-stream").await;
+        assert_eq!(result, "image/png");
+    }
+
+    #[tokio::test]
+    async fn from_file_falls_back_to_extension() {
+        let mut tmp = tempfile::NamedTempFile::new().unwrap();
+        tmp.write_all(b"not magic").unwrap();
+        tmp.flush().unwrap();
+
+        let result =
+            refine_content_type_from_file(tmp.path(), "doc.css", "application/octet-stream").await;
+        assert_eq!(result, "text/css");
+    }
+
+    #[tokio::test]
+    async fn from_file_trusts_specific_claimed() {
+        let result = refine_content_type_from_file(
+            Path::new("/nonexistent"),
+            "file",
+            "image/webp",
+        )
+        .await;
+        assert_eq!(result, "image/webp");
+    }
+
+    #[tokio::test]
+    async fn from_file_missing_file_falls_back_to_extension() {
+        let result = refine_content_type_from_file(
+            Path::new("/nonexistent/file"),
+            "photo.jpg",
+            "application/octet-stream",
+        )
+        .await;
+        assert_eq!(result, "image/jpeg");
+    }
+
+    // ── filename_from_path ──────────────────────────────────────
+
+    #[test]
+    fn extracts_filename_from_deep_path() {
+        assert_eq!(filename_from_path("a/b/c/photo.jpg"), "photo.jpg");
+    }
+
+    #[test]
+    fn returns_input_when_no_slash() {
+        assert_eq!(filename_from_path("photo.jpg"), "photo.jpg");
+    }
+
+    #[test]
+    fn handles_trailing_slash() {
+        assert_eq!(filename_from_path("a/b/"), "");
+    }
+}

src/common/stubs.rs

@@ -467,7 +467,12 @@ impl FileUploadUseCase for StubFileUploadUseCase {
         Ok(FileDto::default())
     }
 
-    async fn update_file(&self, _path: &str, _content: &[u8]) -> Result<(), DomainError> {
+    async fn update_file(
+        &self,
+        _path: &str,
+        _content: &[u8],
+        _content_type: &str,
+    ) -> Result<(), DomainError> {
         Ok(())
     }