feat(user-profile): enforce upload policy on photo selection

Gate profile photo picks against the server UploadPolicy before caching
and upload:

- Reject MIME types the policy doesn't accept (checked against the
  re-encoded upload type, not the source, so HEIC/WebP that normalize
  into an accepted format still pass).
- Derive the downscale target from the policy's dimension + pixel caps
  (min of maxWidth, maxHeight, and sqrt(maxPixels)) instead of a
  hardcoded 500px; falls back to 500 when no constraints are named.
- Enforce maxSizeBytes on the re-encoded output before upload, adding
  ContentReader.size() for the measurement.

Fails open when the policy hasn't loaded; the server remains
authoritative. Rejections clear the preview and surface an alert.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: bmc08gt

apps/flipcash/core/src/main/res/values/strings.xml

@@ -722,6 +722,9 @@
     <string name="error_title_imageNotSupported">This Image is Not Supported</string>
     <string name="error_description_imageNotSupported">Try a different image format</string>
 
+    <string name="error_title_imageTooLarge">This Image is Too Large</string>
+    <string name="error_description_imageTooLarge">Try a smaller image</string>
+
     <string name="error_title_descriptionNotAllowed">This Description is Not Allowed</string>
     <string name="error_description_descriptionNotAllowed">Try a different currency description</string>
 

apps/flipcash/features/user-profile/src/main/kotlin/com/flipcash/app/userprofile/internal/photo/PhotoSelectionViewModel.kt

@@ -1,11 +1,13 @@
 package com.flipcash.app.userprofile.internal.photo
 
 import android.net.Uri
+import androidx.annotation.StringRes
 import androidx.lifecycle.viewModelScope
 import com.flipcash.app.blob.BlobStorageCoordinator
 import com.flipcash.app.core.data.Loadable
 import com.flipcash.app.core.extensions.flatMapResult
 import com.flipcash.app.core.extensions.onResult
+import com.flipcash.services.models.blob.ImageConstraints
 import com.flipcash.services.models.blob.UploadPolicy
 import com.flipcash.features.userprofile.R
 import com.flipcash.libs.coroutines.DispatcherProvider
@@ -33,6 +35,8 @@ import kotlinx.coroutines.flow.mapNotNull
 import kotlinx.coroutines.flow.onEach
 import kotlinx.coroutines.launch
 import javax.inject.Inject
+import kotlin.math.floor
+import kotlin.math.sqrt
 import kotlin.time.Duration.Companion.milliseconds
 
 @HiltViewModel
@@ -87,14 +91,38 @@ class PhotoSelectionViewModel @Inject constructor(
             .filterIsInstance<Event.OnImageSelected>()
             .mapNotNull { event ->
                 val sourceMime = contentReader.mimeType(event.image)
+                // The cache re-encodes to JPEG/PNG, so gate on the type we'd actually upload —
+                // not the source type, which may normalize into an accepted format (e.g. HEIC → PNG).
+                val uploadMime = uploadMimeFor(sourceMime)
+                val policy = stateFlow.value.uploadPolicy
+                val constraints = policy?.constraintsFor(uploadMime)
+                if (policy != null && constraints == null) {
+                    rejectImage(
+                        title = R.string.error_title_imageNotSupported,
+                        message = R.string.error_description_imageNotSupported,
+                    )
+                    return@mapNotNull null
+                }
+                // Downscale to honor the policy's dimension + pixel caps. copyToCache bounds the
+                // longest edge, so the smallest of (maxWidth, maxHeight, √maxPixels) satisfies all three.
                 val cached = contentReader.copyToCache(
                     uri = event.image,
                     fileName = "user_profile_${System.nanoTime()}",
-                    maxSize = 500,
+                    maxSize = maxEdgeFor(constraints?.image),
                     mimeType = sourceMime,
                 ) ?: return@mapNotNull null
+                // Enforce the byte ceiling on the re-encoded output before it rides to the server.
+                val maxBytes = constraints?.maxSizeBytes
+                if (maxBytes != null && (contentReader.size(cached) ?: 0L) > maxBytes) {
+                    contentReader.removeFromCache(cached)
+                    rejectImage(
+                        title = R.string.error_title_imageTooLarge,
+                        message = R.string.error_description_imageTooLarge,
+                    )
+                    return@mapNotNull null
+                }
                 // The cache re-encodes (stripping EXIF); declare the type those bytes actually are.
-                cached to uploadMimeFor(sourceMime)
+                cached to uploadMime
             }
             .flowOn(dispatchers.IO)
             .onEach { (cached, mime) -> dispatchEvent(Event.OnImageCached(cached, mime)) }
@@ -165,8 +193,34 @@ class PhotoSelectionViewModel @Inject constructor(
             .launchIn(viewModelScope)
     }
 
+    /** Clears the pending selection and surfaces [title]/[message] to the user. */
+    private fun rejectImage(@StringRes title: Int, @StringRes message: Int) {
+        dispatchEvent(Event.OnImageCleared)
+        BottomBarManager.showAlert(
+            title = resources.getString(title),
+            message = resources.getString(message),
+        )
+    }
+
+    /**
+     * The longest-edge cap that satisfies every dimension constraint in [image]: the smallest of
+     * maxWidth, maxHeight, and √maxPixels (bounding the longest edge by √maxPixels keeps total area
+     * ≤ maxPixels). Falls back to [DEFAULT_MAX_EDGE] when the policy names no image constraints.
+     */
+    private fun maxEdgeFor(image: ImageConstraints?): Int {
+        val caps = listOfNotNull(
+            image?.maxWidth,
+            image?.maxHeight,
+            image?.maxPixels?.let { floor(sqrt(it.toDouble())).toInt() },
+        ).filter { it > 0 }
+        return caps.minOrNull() ?: DEFAULT_MAX_EDGE
+    }
+
     companion object {
 
+        // Longest-edge downscale target used when the upload policy specifies no dimension caps.
+        private const val DEFAULT_MAX_EDGE = 500
+
         private val updateStateForEvent: (Event) -> (State.() -> State) = { event ->
             when (event) {
                 Event.CheckImage -> { state -> state }

ui/resources/src/main/java/com/getcode/util/resources/ContentReader.kt

@@ -21,6 +21,8 @@ interface ContentReader {
      */
     fun copyToCache(uri: Uri, fileName: String, maxSize: Int = Int.MAX_VALUE, mimeType: String? = null): Uri?
     fun removeFromCache(uri: Uri)
+    /** The size of [uri]'s content in bytes, or null if it can't be resolved. */
+    fun size(uri: Uri): Long?
 }
 
 private const val EXTENSION_JPG = "jpg"
@@ -105,4 +107,18 @@ class AndroidContentReader(private val context: Context) : ContentReader {
     override fun removeFromCache(uri: Uri) {
         uri.path?.let { File(it).delete() }
     }
+
+    override fun size(uri: Uri): Long? {
+        // file:// (our cache) — measure the file directly; otherwise ask the resolver.
+        if (uri.scheme == "file") {
+            uri.path?.let { File(it).takeIf(File::exists)?.length()?.let { len -> return len } }
+        }
+        return try {
+            context.contentResolver.openAssetFileDescriptor(uri, "r")?.use { fd ->
+                fd.length.takeIf { it >= 0 }
+            }
+        } catch (_: java.io.FileNotFoundException) {
+            null
+        }
+    }
 }