fix(chat): wire MIME allowlist into config reload and reject malformed MIME types

- Apply chat.attachment_allowed_mime_types changes during hot reload.
- Validate MIME strings have exactly two non-empty parts before allowlist matching.
- Bump version to 0.1.107.

Signed-off-by: Eli Ma <eli@patch.sh>

Author: genedna

Cargo.lock

@@ -3,7 +3,7 @@ members = ["bin"]
 
 [package]
 name = "monoengine-core"
-version = "0.1.106"
+version = "0.1.107"
 edition = "2024"
 
 [lib]

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "monoengine"
-version = "0.1.106"
+version = "0.1.107"
 edition = "2024"
 
 # The thin composition-root binary. It depends on `monoengine-core` (which only

bin/Cargo.toml

@@ -70,9 +70,12 @@ fn validate_chat_attachment_metadata(
     }
 
     let file_type = file_type.trim();
+    let mime_parts: Vec<&str> = file_type.split('/').collect();
     if file_type.is_empty()
         || file_type.len() > CHAT_ATTACHMENT_MAX_FILE_TYPE_LEN
-        || !file_type.contains('/')
+        || mime_parts.len() != 2
+        || mime_parts[0].is_empty()
+        || mime_parts[1].is_empty()
         || file_type.chars().any(char::is_control)
     {
         return Err(ApiError::bad_request(anyhow::anyhow!(
@@ -881,6 +884,20 @@ mod tests {
         assert!(validate_chat_attachment_metadata("x.txt", "text/plain", 0, &[]).is_err());
         assert!(validate_chat_attachment_metadata("x.txt", "not-a-mime", 1, &[]).is_err());
         assert!(validate_chat_attachment_metadata("x.txt", "text/plain", 1, &[]).is_ok());
+        // Malformed MIME strings must be rejected even when an allowlist is present.
+        assert!(
+            validate_chat_attachment_metadata("x.png", "image/", 1, &["image/*".to_string()])
+                .is_err()
+        );
+        assert!(
+            validate_chat_attachment_metadata(
+                "x.png",
+                "image/png/extra",
+                1,
+                &["image/*".to_string()]
+            )
+            .is_err()
+        );
     }
 
     #[test]

src/api/router/chat_router.rs

@@ -15,7 +15,7 @@ use tokio::{
 use crate::{
     common::errors::MegaError,
     config::{
-        ArtifactGcConfig, BuckConfig, Config, DEFAULT_MAIL_TEMPLATE_LOCALE,
+        ArtifactGcConfig, BuckConfig, ChatConfig, Config, DEFAULT_MAIL_TEMPLATE_LOCALE,
         DEFAULT_NOTIFICATION_DELIVERY_MODE, LogConfig, MailConfig, NotificationConfig,
     },
 };
@@ -146,6 +146,7 @@ impl ConfigHandle {
             &mut next.notification,
             &mut report,
         );
+        apply_chat_changes(&current.chat, &candidate.chat, &mut next.chat, &mut report);
         collect_database_restart_fields(&current, &candidate, &mut report);
         collect_redis_restart_fields(&current, &candidate, &mut report);
         collect_static_restart_fields(&current, &candidate, &mut report);
@@ -679,6 +680,36 @@ fn notification_default_locale(config: &Option<NotificationConfig>) -> String {
         .unwrap_or_else(|| DEFAULT_MAIL_TEMPLATE_LOCALE.to_string())
 }
 
+/// `chat.attachment_allowed_mime_types` is read live by the attachment handlers,
+/// so changes can be hot-applied without a restart.
+fn apply_chat_changes(
+    current: &Option<ChatConfig>,
+    candidate: &Option<ChatConfig>,
+    next: &mut Option<ChatConfig>,
+    report: &mut ConfigReloadReport,
+) {
+    if current == candidate {
+        return;
+    }
+
+    let current_list = chat_mime_allowlist(current);
+    let candidate_list = chat_mime_allowlist(candidate);
+    *next = candidate.clone();
+
+    if current_list != candidate_list {
+        report
+            .applied_fields
+            .push("chat.attachment_allowed_mime_types");
+    }
+}
+
+fn chat_mime_allowlist(config: &Option<ChatConfig>) -> Vec<String> {
+    config
+        .as_ref()
+        .map(|c| c.attachment_allowed_mime_types.clone())
+        .unwrap_or_default()
+}
+
 fn collect_artifact_gc_restart_fields(
     current: &ArtifactGcConfig,
     candidate: &ArtifactGcConfig,
@@ -1422,6 +1453,41 @@ mod tests {
         assert!(!snapshot.mail.as_ref().expect("mail config").enabled);
     }
 
+    #[test]
+    fn reload_applies_chat_mime_allowlist_without_restart() {
+        let temp_dir = tempfile::tempdir().expect("temp dir");
+        let mut current = isolated_config(temp_dir.path().join("current"));
+        current.chat = Some(ChatConfig::default());
+        let handle = ConfigHandle::new(current);
+
+        let mut candidate = handle.snapshot().expect("snapshot").as_ref().clone();
+        candidate
+            .chat
+            .as_mut()
+            .expect("chat config")
+            .attachment_allowed_mime_types =
+            vec!["image/*".to_string(), "application/pdf".to_string()];
+
+        let report = handle.reload(candidate).expect("reload should succeed");
+        let snapshot = handle.snapshot().expect("snapshot after reload");
+
+        assert_eq!(
+            report.applied_fields,
+            vec!["chat.attachment_allowed_mime_types"]
+        );
+        assert!(report.restart_required_fields.is_empty());
+        assert!(report.applied());
+        assert!(!report.requires_restart());
+        assert_eq!(
+            snapshot
+                .chat
+                .as_ref()
+                .expect("chat config")
+                .attachment_allowed_mime_types,
+            vec!["image/*".to_string(), "application/pdf".to_string()]
+        );
+    }
+
     #[test]
     fn reload_applies_mail_dispatcher_limits_without_restart() {
         let temp_dir = tempfile::tempdir().expect("temp dir");