fix(api): harden sme invoice upload presigned urls

[levoski1]

Closes #226

---

Summary

Hardens the SME invoice upload flow with presigned URL validation, MIME type enforcement, size limits, tenant-scoped keys, path traversal prevention, and bounded URL expiry.

Changes

src/services/storage.js

• Restrict accepted MIME types: application/pdf, image/jpeg, image/png, image/tiff
• Enforce max file size (512 KB, configurable via BODY_LIMIT_INVOICE)
• Sanitize filenames: strip path separators, null bytes, .., special chars
• Generate tenant/invoice-scoped keys: tenants/{tenantId}/invoices/{invoiceId}/{uuid}-{filename}
• Bound presigned URL TTL: 15 min upload, 1 h download (max 24 h)
• getPresignedUploadUrl(): generates upload URLs with Content-Type/Content-Length constraints
• getSignedUrl(): bounded expiry for download URLs
• Never expose or log AWS credentials

src/routes/sme/index.js

• New POST /api/sme/invoice/presigned-url endpoint for requesting presigned upload URLs
• Existing POST /api/sme/invoice hardened with tenant/invoice scoping

src/routes/invoiceFile.js

• New POST /api/invoices/:id/presigned-upload endpoint scoped to invoice

src/app.js

• Mount SME and invoiceFile routes in createApp()

tests/sme.upload.test.js

• MIME type validation (accept/reject)
• File size rejection
• Presigned URL generation
• Tenant-scoped key generation
• Path traversal prevention
• Credential non-leakage
• InvoiceFile route tests

docs/email-ops.md

• Added SME Invoice Upload Security Hardening section

Testing

• All storage service hardening logic verified: MIME validation, filename sanitization, key scoping, size enforcement
• Route behavior tested via mocked storage service
• CI pipeline runs npm test (Jest with --runInBand --forceExit)

Security Notes

• AWS credentials are never returned in API responses or logged
• MIME types validated server-side before URL generation
• Content-Type and Content-Length embedded in presigned URLs for S3-side enforcement
• Error messages do not leak internal state or stack traces
• Object keys include UUID to prevent enumeration

[drips-wave]

@levoski1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits