pida-core/core-api/src/main/resources/application.yml (1)

23-26: Add explicit validation to multipart upload endpoints and adjust size configuration.

Only two multipart upload endpoints exist in the codebase (FlowerSpotCafeController.uploadThumbnail and FlowerEventController.uploadThumbnail), both admin-only. The global spring.servlet.multipart configuration is appropriate here since no other multipart endpoints exist.

However, consider these improvements:

1. Neither endpoint has explicit size validation — they rely solely on the global limit. Add validation at the controller level for defense in depth:

   require(thumbnail.size <= 10 * 1024 * 1024) { "File size must not exceed 10MB" }
   require(thumbnail.contentType?.startsWith("image/") == true) { "Only image files are allowed" }

2. Adjust max-request-size for headroom — both are set to 10MB, leaving no room for other multipart fields. Set max-request-size: 12MB to accommodate the file plus metadata.

3. Document the 10MB choice — add a comment explaining why this limit was selected (e.g., support for high-resolution thumbnails).

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pida-core/core-api/src/main/resources/application.yml` around lines 23 - 26,
Update the multipart configuration and add defense-in-depth checks: change
spring.servlet.multipart.max-request-size to 12MB in application.yml (leave
max-file-size at 10MB and add a short comment documenting the 10MB choice for
high-resolution thumbnails), and add explicit validation inside
FlowerSpotCafeController.uploadThumbnail and
FlowerEventController.uploadThumbnail to assert thumbnail.size <= 10 * 1024 *
1024 and thumbnail.contentType?.startsWith("image/") == true (throw a bad
request / require failure with a clear message) so uploads are validated at the
controller level even if global limits change.