fix: harden course video upload validation

[Jidnyasa-P]

Summary

Strengthen course video uploads with secure MP4 validation, configurable upload limits, safe filenames, controlled error responses, and automatic cleanup of partially uploaded/orphaned files.

Related Issue

Closes #44

What changed?

• Added strict MP4 validation using both file extension and MIME type.
• Added configurable maximum video size and maximum number of section videos.
• Added sanitized server-generated filenames and safe upload cleanup.
• Added cleanup handling when Multer or course creation fails.
• Added backend tests covering validation, limits, error handling, filename safety, and cleanup.

Type

• Bug fix
• New feature
• Refactor
• Docs only
• Tests
• Config / workflow
• Security
• Breaking change

Areas touched

• Frontend
• Backend
• Database
• Docs
• Workflow / GitHub Actions
• Config / environment

Testing

• Tested locally
• Build passes
• Lint passes
• Tests added or updated
• Docs only, no runtime testing needed

Test steps

1. Installed the backend dependencies and ran the focused video-upload test suite.
2. Verified MP4 extension/MIME validation, upload-size and upload-count limits, sanitized filenames, safe cleanup, and controlled 400/413 responses.
3. Ran the backend syntax checks for the modified upload, controller, and router files.

Test result

TAP version 13

# Subtest: valid MP4 files are accepted
ok 1 - valid MP4 files are accepted

# Subtest: renamed non-video files are rejected
ok 2 - renamed non-video files are rejected

# Subtest: unsupported MIME types are rejected
ok 3 - unsupported MIME types are rejected

# Subtest: non-MP4 extension is rejected even with MP4 MIME
ok 4 - non-MP4 extension is rejected even with MP4 MIME

# Subtest: defaults to 250 MB and 20 files
ok 5 - defaults to 250 MB and 20 files

# Subtest: upload limits are configurable
ok 6 - upload limits are configurable

# Subtest: invalid limit config falls back safely
ok 7 - invalid limit config falls back safely

# Subtest: oversized uploads return 413 without internal path
ok 8 - oversized uploads return 413 without internal path

# Subtest: too many videos returns controlled 400
ok 9 - too many videos returns controlled 400

# Subtest: generated filenames are sanitized
ok 10 - generated filenames are sanitized

# Subtest: cleanup constrains filenames to upload directory
ok 11 - cleanup constrains filenames to upload directory

# Subtest: cleanup removes written files and ignores missing files
ok 12 - cleanup removes written files and ignores missing files

# Subtest: failed course creation removes uploaded files
ok 13 - failed course creation removes uploaded files

# Subtest: upload middleware cleans partial files after Multer error
ok 14 - upload middleware cleans partial files after Multer error

1..14
# tests 14
# suites 0
# pass 14
# fail 0
# cancelled 0
# skipped 0
# todo 0

Result: 14/14 tests passed.

Screenshots

• Not needed
• Added below

Edge cases checked

• Empty or missing data
• Loading / slow response
• API failure / server error
• Rate limit / throttling
• Invalid or unexpected input
• Permission / access denied
• Partial or inconsistent data
• Mobile / small screen behavior
• Other

Other edge case details

• Renamed non-video files using an .mp4 extension are rejected.
• Unsupported MIME types are rejected.
• Non-MP4 extensions are rejected even when the MIME type claims to be MP4.
• Oversized uploads return 413 without exposing internal filesystem paths.
• Excessive video counts return a controlled 400.
• Invalid upload-limit configuration falls back to safe defaults.
• Generated filenames are sanitized.
• Cleanup is constrained to the upload directory.
• Missing files during cleanup are handled safely.
• Files already written during a failed course-creation request are removed.
• Partially written files from Multer failures are cleaned up.

Checklist

• Read CONTRIBUTING.md
• Linked the issue
• Assigned before starting or approved by maintainer
• Changes are focused on one issue
• No debug logs or unused code
• Documentation updated if needed
• No new warnings or console errors
• Changes are meaningful, not trivial

Notes

This is a backend-only security hardening change, so no frontend/UI changes or screenshots are applicable.

The implementation keeps the existing course-upload flow while adding validation and cleanup around uploaded section videos.

The focused test suite contains 14 tests, and all 14 passed successfully.