feat(M09-B): 完成清洁规则与照片验收闭环

backend/tests/content-management.test.mjs

@@ -21,7 +21,18 @@ try {
   assert.equal(image.mimeType, 'image/webp');
   assert.ok(image.width <= 1920);
   assert.match(image.storagePath, /^tenants\/7\/stores\/11\/.+\.webp$/);
-  assert.ok((await readFile(join(root, ...image.storagePath.split('/')))).length > 0);
+  const storedPath = join(root, ...image.storagePath.split('/'));
+  const storedBytes = await readFile(storedPath);
+  assert.ok(storedBytes.length > 0);
+  const storedMetadata = await sharp(storedBytes).metadata();
+  assert.equal(storedMetadata.exif, undefined);
+  assert.equal(storedMetadata.icc, undefined);
+  await assert.rejects(
+    () => storage.storeImage({
+      tenantId: '7', originalName: 'spoofed.jpg', contentType: 'image/jpeg', body: png
+    }),
+    (error) => error instanceof MediaValidationError && error.code === 'IMAGE_DECODE_FAILED'
+  );
   await assert.rejects(
     () => storage.storeImage({
       tenantId: '7', originalName: 'bad.txt', contentType: 'text/plain',
@@ -29,6 +40,12 @@ try {
     }),
     (error) => error instanceof MediaValidationError && error.code === 'IMAGE_TYPE_INVALID'
   );
+  await storage.deleteImage(image.storagePath);
+  await assert.rejects(() => readFile(storedPath), (error) => error.code === 'ENOENT');
+  await assert.rejects(
+    () => storage.deleteImage('../outside.webp'),
+    (error) => error instanceof MediaValidationError && error.code === 'IMAGE_PATH_INVALID'
+  );
 } finally {
   await rm(root, { recursive: true, force: true });
 }