chore: import DH V2 D5.6.4 production baseline

api-v3/test/unit/inspection-evidence-file.test.ts

@@ -0,0 +1,40 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { InspectionEvidenceKind } from '../../src/database/entities';
+import {
+  inspectInspectionEvidenceFile,
+  MAX_INSPECTION_EVIDENCE_BYTES,
+} from '../../src/inspection-findings/inspection-evidence-file';
+
+function file(buffer: Buffer, originalname: string) {
+  return { buffer, originalname, size: buffer.length };
+}
+
+test('D4 evidence detects content by magic bytes', () => {
+  const photo = inspectInspectionEvidenceFile(
+    file(Buffer.from([0xff, 0xd8, 0xff, 0xe0, 0x00]), 'evidencia.pdf'),
+    InspectionEvidenceKind.PHOTO,
+  );
+  assert.equal(photo.mimeType, 'image/jpeg');
+  const document = inspectInspectionEvidenceFile(
+    file(Buffer.from('%PDF-1.7'), 'respuesta.bin'),
+    InspectionEvidenceKind.DOCUMENT,
+  );
+  assert.equal(document.mimeType, 'application/pdf');
+});
+
+test('D4 evidence rejects executable text, mismatches and oversize files', () => {
+  assert.throws(() => inspectInspectionEvidenceFile(
+    file(Buffer.from('<script>alert(1)</script>'), 'foto.jpg'),
+    InspectionEvidenceKind.PHOTO,
+  ));
+  assert.throws(() => inspectInspectionEvidenceFile(
+    file(Buffer.from('%PDF-1.7'), 'foto.pdf'),
+    InspectionEvidenceKind.PHOTO,
+  ));
+  assert.throws(() => inspectInspectionEvidenceFile({
+    buffer: Buffer.from([0xff, 0xd8, 0xff]),
+    originalname: 'grande.jpg',
+    size: MAX_INSPECTION_EVIDENCE_BYTES + 1,
+  }, InspectionEvidenceKind.PHOTO));
+});