@cosmicdrift/kumiko-framework 0.313.0 → 0.315.0

package/src/files/__tests__/files.integration.test.ts

@@ -8,6 +8,7 @@ import { buildServer } from "../../api/server";
 import { configurePiiSubjectKms, InMemoryKmsAdapter } from "../../crypto";
 import {
   createEntity,
+  createFileField,
   createImageField,
   createRegistry,
   createTextField,
@@ -35,7 +36,13 @@ import type { FileRoutesOptions } from "../file-routes";
 import { createInMemoryFileProvider } from "../in-memory-provider";
 import { createLocalProvider } from "../local-provider";
 import type { FileStorageProvider, SignedUrlOptions } from "../types";
-import { parseMaxSize, sniffMimeType, validateFile, validateFileContent } from "../types";
+import {
+  parseMaxSize,
+  resolveUploadMimeType,
+  sniffMimeType,
+  validateFile,
+  validateFileContent,
+} from "../types";
 
 // UUID for "this row doesn't exist" assertions. Valid v4 format so PG accepts
 // the query — the row just isn't there. Pre-v1 files-feature tests used
@@ -59,6 +66,7 @@ const testTenantEntity = createEntity({
   fields: {
     name: createTextField({ personal: false, reason: "test_fixture", required: true }),
     logo: createImageField({ maxSize: "2mb", accept: ["png", "jpg"] }),
+    importFile: createFileField({ maxSize: "2mb", accept: ["csv"] }),
   },
 });
 
@@ -257,37 +265,58 @@ describe("file validation", () => {
     ).toBeNull();
   });
 
-  test("validateFileContent accepts .doc/.docx bytes matching their declared mimeType", () => {
-    expect(validateFileContent("application/msword", docBytes)).toBeNull();
-    expect(
-      validateFileContent(
-        "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-        docxBytes,
-      ),
-    ).toBeNull();
+  test("validateFileContent accepts .doc/.docx bytes matching their declared extension", () => {
+    expect(validateFileContent("report.doc", docBytes)).toBeNull();
+    expect(validateFileContent("report.docx", docxBytes)).toBeNull();
   });
 
-  test("validateFileContent rejects .doc/.docx whose content doesn't match the declared mimeType", () => {
+  test("validateFileContent rejects .doc/.docx whose content doesn't match the extension", () => {
     const fakeDoc = validateFileContent(
-      "application/msword",
+      "fake.doc",
       new TextEncoder().encode("not actually a Word document, just text"),
     );
     expectErrorIncludes(fakeDoc, "content_mismatch");
 
     const fakeDocx = validateFileContent(
-      "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+      "fake.docx",
       new TextEncoder().encode("not actually a docx, just text"),
     );
     expectErrorIncludes(fakeDocx, "content_mismatch");
   });
 
-  test("validateFileContent does not content-verify pre-existing types (e.g. pdf) even when content mismatches", () => {
-    expect(
-      validateFileContent(
-        "application/pdf",
-        new TextEncoder().encode("not a PDF at all, just text"),
-      ),
-    ).toBeNull();
+  test("validateFileContent now content-verifies every signature-bearing extension (e.g. pdf), not just doc/docx", () => {
+    const mismatch = validateFileContent(
+      "fake.pdf",
+      new TextEncoder().encode("not a PDF at all, just text"),
+    );
+    expectErrorIncludes(mismatch, "content_mismatch");
+  });
+
+  test("validateFileContent leaves extensions without a magic-byte signature unchecked (csv/txt/svg/md/json/unknown)", () => {
+    const text = new TextEncoder().encode("just plain text, not any binary format");
+    expect(validateFileContent("data.csv", text)).toBeNull();
+    expect(validateFileContent("notes.txt", text)).toBeNull();
+    expect(validateFileContent("readme.md", text)).toBeNull();
+    expect(validateFileContent("data.json", text)).toBeNull();
+    expect(validateFileContent("logo.svg", text)).toBeNull();
+    expect(validateFileContent("file.unknownext", text)).toBeNull();
+  });
+
+  test("validateFileContent treats a prototype-property extension as unknown instead of crashing", () => {
+    expect(validateFileContent("evil.constructor", docBytes)).toBeNull();
+    expect(validateFileContent("evil.__proto__", docBytes)).toBeNull();
+    expect(validateFileContent("evil.toString", docBytes)).toBeNull();
+  });
+
+  test("validateFile with accept: ['constructor'] and a matching filename never throws", () => {
+    let result: string | null = null;
+    expect(() => {
+      result = validateFile(
+        { fileName: "x.constructor", mimeType: "application/octet-stream", size: 10 },
+        { accept: ["constructor"] },
+      );
+    }).not.toThrow();
+    expect(result === null || typeof result === "string").toBe(true);
   });
 
   test("sniffMimeType recognizes doc (OLE) and docx (ZIP) signatures", () => {
@@ -296,6 +325,91 @@ describe("file validation", () => {
       "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
     );
   });
+
+  // --- .csv declared as application/vnd.ms-excel (Windows browsers) ---
+
+  test("validateFile accepts .csv declared as application/vnd.ms-excel when csv is in accept", () => {
+    expect(
+      validateFile(
+        { fileName: "data.csv", mimeType: "application/vnd.ms-excel", size: 100 },
+        { accept: ["csv"] },
+      ),
+    ).toBeNull();
+  });
+
+  test("validateFile does not extend the vnd.ms-excel alias to extensions other than csv", () => {
+    const error = validateFile(
+      { fileName: "photo.jpg", mimeType: "application/vnd.ms-excel", size: 100 },
+      { accept: ["jpg"] },
+    );
+    expectErrorIncludes(error, "mime_mismatch");
+  });
+
+  test("validateFile rejects a prototype-property mimeType instead of treating it as an alias match", () => {
+    const error = validateFile(
+      { fileName: "photo.jpg", mimeType: "constructor", size: 100 },
+      { accept: ["jpg"] },
+    );
+    expectErrorIncludes(error, "mime_mismatch");
+  });
+
+  describe("resolveUploadMimeType", () => {
+    const textCsvBytes = new TextEncoder().encode("name,age\nAda,36\n");
+
+    test("rewrites .csv + application/vnd.ms-excel to text/csv when bytes are text", () => {
+      expect(resolveUploadMimeType("data.csv", "application/vnd.ms-excel", textCsvBytes)).toEqual({
+        kind: "ok",
+        mimeType: "text/csv",
+      });
+    });
+
+    test("rewrites regardless of charset suffix or case", () => {
+      expect(
+        resolveUploadMimeType("data.csv", "Application/VND.MS-EXCEL; charset=utf-8", textCsvBytes),
+      ).toEqual({ kind: "ok", mimeType: "text/csv" });
+    });
+
+    test("rejects .csv + application/vnd.ms-excel when bytes are a real OLE binary", () => {
+      const result = resolveUploadMimeType("data.csv", "application/vnd.ms-excel", docBytes);
+      expect(result.kind).toBe("rejected");
+      if (result.kind === "rejected") {
+        expectErrorIncludes(result.error, "content_mismatch");
+      }
+    });
+
+    test("rejects .csv + application/vnd.ms-excel when bytes are a ZIP container (.xlsx)", () => {
+      const result = resolveUploadMimeType("data.csv", "application/vnd.ms-excel", docxBytes);
+      expect(result.kind).toBe("rejected");
+      if (result.kind === "rejected") {
+        expectErrorIncludes(result.error, "content_mismatch");
+      }
+    });
+
+    test("leaves .csv + text/plain unchanged", () => {
+      expect(resolveUploadMimeType("data.csv", "text/plain", textCsvBytes)).toEqual({
+        kind: "ok",
+        mimeType: "text/plain",
+      });
+    });
+
+    test("leaves .xls + application/vnd.ms-excel unchanged (alias is csv-only)", () => {
+      expect(resolveUploadMimeType("data.xls", "application/vnd.ms-excel", docBytes)).toEqual({
+        kind: "ok",
+        mimeType: "application/vnd.ms-excel",
+      });
+    });
+
+    test("a prototype-property extension or mimeType never resolves as an alias", () => {
+      expect(resolveUploadMimeType("x.constructor", "name", textCsvBytes)).toEqual({
+        kind: "ok",
+        mimeType: "name",
+      });
+      expect(resolveUploadMimeType("data.csv", "constructor", textCsvBytes)).toEqual({
+        kind: "ok",
+        mimeType: "constructor",
+      });
+    });
+  });
 });
 
 // --- Integration: Upload → Download → Delete via real HTTP API ---
@@ -523,6 +637,124 @@ describe("doc/docx upload is content-verified against magic bytes", () => {
   });
 });
 
+// --- Content-verification is keyed on the filename extension, not the ---
+// --- declared/runtime mimeType (Option A, kumiko-framework#3287)       ---
+
+describe("content_mismatch is enforced by filename extension for every signature-bearing type", () => {
+  const jpegBytes = new Uint8Array([0xff, 0xd8, 0xff, 0xe0, ...Array(20).fill(0)]);
+  const pngBytes = new Uint8Array([
+    0x89,
+    0x50,
+    0x4e,
+    0x47,
+    0x0d,
+    0x0a,
+    0x1a,
+    0x0a,
+    ...Array(20).fill(0),
+  ]);
+  const pdfBytes = new TextEncoder().encode("%PDF-1.4 minimal");
+  const docBytes = new Uint8Array([
+    0xd0,
+    0xcf,
+    0x11,
+    0xe0,
+    0xa1,
+    0xb1,
+    0x1a,
+    0xe1,
+    ...Array(20).fill(0),
+  ]);
+  const docxBytes = new Uint8Array([0x50, 0x4b, 0x03, 0x04, ...Array(20).fill(0)]);
+
+  test("PDF bytes uploaded as x.jpg against an accept: [jpg] field are rejected with content_mismatch", async () => {
+    const res = await uploadFile(adminUser, "x.jpg", pdfBytes, "image/jpeg", {
+      entityType: "tenant",
+      entityId: "1",
+      fieldName: "logo",
+    });
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toContain("content_mismatch");
+  });
+
+  test("real signature bytes with a matching extension upload successfully", async () => {
+    for (const [fileName, bytes, mimeType] of [
+      ["real.jpg", jpegBytes, "image/jpeg"],
+      ["real.png", pngBytes, "image/png"],
+      ["real.pdf", pdfBytes, "application/pdf"],
+      ["real.doc", docBytes, "application/msword"],
+      [
+        "real.docx",
+        docxBytes,
+        "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+      ],
+    ] as const) {
+      const res = await uploadFile(adminUser, fileName, bytes, mimeType);
+      expect(res.status).toBe(201);
+    }
+  });
+
+  test(".csv and .txt plain text upload successfully (no magic-byte signature to check)", async () => {
+    const text = new TextEncoder().encode("name,age\nAda,36\n");
+    const csvRes = await uploadFile(adminUser, "data.csv", text, "text/csv");
+    expect(csvRes.status).toBe(201);
+    const txtRes = await uploadFile(adminUser, "notes.txt", text, "text/plain");
+    expect(txtRes.status).toBe(201);
+  });
+
+  test("an unattached upload with a prototype-property extension is handled as unknown, not a 500", async () => {
+    const constructorRes = await uploadFile(adminUser, "evil.constructor", pngBytes, "image/png");
+    expect(constructorRes.status).toBe(201);
+    const protoRes = await uploadFile(adminUser, "evil.__proto__", pngBytes, "image/png");
+    expect(protoRes.status).toBe(201);
+  });
+
+  test("a too-short .png upload (fewer bytes than the PNG signature) is rejected with content_mismatch", async () => {
+    // A zero-byte file part is dropped by Bun's multipart parser before it
+    // ever reaches the route handler as `file`, so this uses one byte
+    // instead — still far short of the 8-byte PNG signature.
+    const res = await uploadFile(adminUser, "empty.png", new Uint8Array([0x00]), "image/png");
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toContain("content_mismatch");
+  });
+});
+
+// Bun's formData() derives File#type from the filename, so .csv never
+// arrives as vnd.ms-excel here; the csv alias is covered by the unit tests above.
+describe("vnd.ms-excel via HTTP (.xls)", () => {
+  const docBytes = new Uint8Array([
+    0xd0,
+    0xcf,
+    0x11,
+    0xe0,
+    0xa1,
+    0xb1,
+    0x1a,
+    0xe1,
+    ...Array(20).fill(0),
+  ]);
+
+  test("unattached .xls declared as application/vnd.ms-excel keeps its declared mimeType unchanged", async () => {
+    const res = await uploadFile(adminUser, "legacy.xls", docBytes, "application/vnd.ms-excel");
+    expect(res.status).toBe(201);
+    const body = await res.json();
+    expect(body.mimeType).toBe("application/vnd.ms-excel");
+  });
+
+  test("attached .xls upload is rejected by the importFile field's csv-only accept list", async () => {
+    const res = await uploadFile(adminUser, "legacy.xls", docBytes, "application/vnd.ms-excel", {
+      entityType: "tenant",
+      entityId: "1",
+      fieldName: "importFile",
+    });
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toContain("invalid_file_type");
+  });
+});
+
 // --- Cross-user access within a tenant (attached file owner-scope) ---
 
 describe("attached file owner-scope", () => {
@@ -746,7 +978,7 @@ describe("custom file access guard", () => {
 
 describe("tenant isolation", () => {
   test("tenant 2 uploads a file, tenant 1 cannot see it", async () => {
-    const content = new TextEncoder().encode("tenant2-secret-file");
+    const content = new TextEncoder().encode("%PDF-1.4 tenant2-secret-file");
     const uploadRes = await uploadFile(otherTenantUser, "secret.pdf", content, "application/pdf");
     expect(uploadRes.status).toBe(201);
     const { id } = await uploadRes.json();

package/src/files/__tests__/storage-tracking.integration.test.ts

@@ -38,9 +38,11 @@ const otherAdmin = createTestUser({
 });
 
 // Two tiny payloads with distinct lengths so the sum assertion can tell
-// them apart without relying on the underlying bytes.
-const SMALL = new Uint8Array([0x89, 0x50, 0x4e, 0x47, ...Array(16).fill(0)]); // 20 bytes, PNG-ish
-const LARGE = new Uint8Array([0x89, 0x50, 0x4e, 0x47, ...Array(96).fill(0)]); // 100 bytes
+// them apart without relying on the underlying bytes. Both carry the full
+// 8-byte PNG signature so validateFileContent accepts them.
+const PNG_SIGNATURE = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
+const SMALL = new Uint8Array([...PNG_SIGNATURE, ...Array(12).fill(0)]); // 20 bytes
+const LARGE = new Uint8Array([...PNG_SIGNATURE, ...Array(92).fill(0)]); // 100 bytes
 
 beforeAll(async () => {
   patchFileInstanceofForBunTest();

package/src/files/file-routes.ts

@@ -30,6 +30,7 @@ import type { FileProviderResolver } from "./provider-resolver";
 import {
   buildStorageKey,
   resolveServedContentType,
+  resolveUploadMimeType,
   validateFile,
   validateFileContent,
 } from "./types";
@@ -235,18 +236,24 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
 
     const data = new Uint8Array(await file.arrayBuffer());
 
-    const contentValidationError = validateFileContent(file.type, data);
+    const contentValidationError = validateFileContent(file.name, data);
     if (contentValidationError) {
       return c.json({ error: contentValidationError }, 400);
     }
 
+    const mimeTypeResolution = resolveUploadMimeType(file.name, file.type, data);
+    if (mimeTypeResolution.kind === "rejected") {
+      return c.json({ error: mimeTypeResolution.error }, 400);
+    }
+    const mimeType = mimeTypeResolution.mimeType;
+
     // Write binary FIRST (outside the tx — network/disk I/O doesn't belong
     // inside a PG connection's tx window). On DB-tx rollback below the bytes
     // are orphaned in the provider; cleanup-jobs sweep those later. Losing a
     // row on append-failure is acceptable; corrupting a committed row with a
     // missing binary is not.
     const storageProvider = await options.resolveProvider(user.tenantId);
-    await storageProvider.write(storageKey, data, file.type);
+    await storageProvider.write(storageKey, data, mimeType);
 
     // Create via the standard entity executor: emits fileRef.created +
     // materialises the file_refs row in one tx (read-your-own-write). id is
@@ -260,7 +267,7 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
         id: fileRefId,
         storageKey,
         fileName: file.name,
-        mimeType: file.type,
+        mimeType,
         size: file.size,
         entityType: entityType ?? null,
         entityId: entityId ?? null,
@@ -277,7 +284,7 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
       {
         id: fileRefId,
         fileName: file.name,
-        mimeType: file.type,
+        mimeType,
         size: file.size,
         storageKey,
       },

package/src/files/index.ts

@@ -37,6 +37,7 @@ export type {
   FileStorageProvider,
   FileValidationOptions,
   SignedUrlOptions,
+  UploadMimeTypeResolution,
   WriteStreamOptions,
 } from "./types";
 export {
@@ -44,6 +45,8 @@ export {
   buildStorageKey,
   normalizeMimeType,
   parseMaxSize,
+  resolveUploadMimeType,
+  sniffMimeType,
   tenantExportPrefix,
   tenantStoragePrefixes,
   validateFile,

package/src/files/types.ts

@@ -34,10 +34,14 @@ export function parseMaxSize(maxSize: string): number {
   }
 }
 
-// Extension → acceptable MIME-type whitelist. Guards against a client
-// uploading e.g. name="x.jpg" with mimeType="application/pdf" to slip an
-// executable past the extension-only check. Kept small & conservative — add
-// entries on demand rather than importing a heavyweight mime DB.
+function extractExtension(fileName: string): string | undefined {
+  return fileName.split(".").pop()?.toLowerCase();
+}
+
+// Extension → acceptable MIME-type whitelist. Backs the cheap metadata
+// pre-check in validateFile AND the signature lookup in validateFileContent.
+// Kept small & conservative; add entries on demand rather than importing a
+// heavyweight mime DB.
 const EXTENSION_MIME_WHITELIST: Record<string, readonly string[]> = {
   jpg: ["image/jpeg", "image/jpg"],
   jpeg: ["image/jpeg", "image/jpg"],
@@ -54,8 +58,30 @@ const EXTENSION_MIME_WHITELIST: Record<string, readonly string[]> = {
   docx: ["application/vnd.openxmlformats-officedocument.wordprocessingml.document"],
 } satisfies Record<string, readonly string[]>;
 
+// Extension → declared MIME → canonical MIME. Windows resolves .csv's upload
+// MIME from Explorer's Excel file association, sending "application/vnd.ms-excel" for plain-text CSV.
+const EXTENSION_MIME_ALIASES: Readonly<Record<string, Readonly<Record<string, string>>>> = {
+  csv: { "application/vnd.ms-excel": "text/csv" },
+};
+
+// Object.hasOwn at both levels: a plain `in` check on `{}` resolves to
+// Object.prototype members ("constructor", …) for any ext/mimeType.
+function lookupMimeAlias(ext: string, normalizedMimeType: string): string | undefined {
+  if (!Object.hasOwn(EXTENSION_MIME_ALIASES, ext)) return undefined;
+  const aliasesForExt = EXTENSION_MIME_ALIASES[ext];
+  if (!aliasesForExt || !Object.hasOwn(aliasesForExt, normalizedMimeType)) return undefined;
+  return aliasesForExt[normalizedMimeType];
+}
+
+// Same hasOwn guard as lookupMimeAlias above, for the ext-keyed whitelist.
+function lookupExtensionWhitelist(ext: string): readonly string[] | undefined {
+  if (!Object.hasOwn(EXTENSION_MIME_WHITELIST, ext)) return undefined;
+  return EXTENSION_MIME_WHITELIST[ext];
+}
+
 // Magic-byte signatures for the subset of EXTENSION_MIME_WHITELIST that has
-// a reliable binary signature. Used at SERVE time — never trust the stored/
+// a reliable binary signature. Used both at upload time (validateFileContent)
+// and at serve time (resolveServedContentType) — never trust the stored/
 // client-declared mimeType for Content-Type on its own, sniff the actual
 // bytes instead. Types without a stable signature (svg, txt, csv, json, md)
 // and anything that matches none of these fall back to
@@ -80,9 +106,8 @@ const MAGIC_BYTE_SIGNATURES: ReadonlyArray<{
     matches: (bytes) => startsWithAscii(bytes, "RIFF") && startsWithAscii(bytes, "WEBP", 8),
   },
   { mimeType: "application/pdf", matches: (bytes) => startsWithAscii(bytes, "%PDF-") },
-  // Full 8-byte OLE Compound File signature (legacy .doc/.xls/.ppt share it —
-  // sniffing can't tell them apart by bytes alone, only content-verification
-  // below narrows to msword specifically).
+  // Full 8-byte OLE Compound File signature — legacy .doc/.xls/.ppt share it,
+  // so any OLE file sniffs as msword regardless of which one it really is.
   {
     mimeType: "application/msword",
     matches: (bytes) => startsWithBytes(bytes, [0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1]),
@@ -108,6 +133,14 @@ function startsWithAscii(bytes: Uint8Array, ascii: string, offset = 0): boolean
   return true;
 }
 
+/**
+ * Canonical MIME type for a known binary magic-byte signature (png, jpeg,
+ * gif, webp, pdf, OLE, ZIP), or null for everything else — text formats
+ * (csv, txt, json, svg, md) have no signature and always return null. Every
+ * OLE Compound File (.doc/.xls/.ppt) returns "application/msword" and every
+ * ZIP (.docx/.xlsx/.pptx/.zip) returns the docx MIME — callers can't tell
+ * those apart by bytes alone.
+ */
 export function sniffMimeType(bytes: Uint8Array): string | null {
   for (const signature of MAGIC_BYTE_SIGNATURES) {
     if (signature.matches(bytes)) return signature.mimeType;
@@ -145,14 +178,6 @@ export function resolveServedContentType(bytes: Uint8Array, declaredMimeType: st
   return sniffed === declared ? sniffed : "application/octet-stream";
 }
 
-// Signature-checked against the declared mimeType regardless of
-// `options.accept`. Deliberately narrow: most of the whitelist has no magic
-// bytes at all and would reject honestly-mislabeled uploads if checked.
-const CONTENT_VERIFIED_MIME_TYPES = new Set([
-  "application/msword",
-  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-]);
-
 export function validateFile(
   metadata: FileMetadata,
   options: FileValidationOptions,
@@ -165,18 +190,17 @@ export function validateFile(
   }
 
   if (options.accept && options.accept.length > 0) {
-    const ext = metadata.fileName.split(".").pop()?.toLowerCase();
+    const ext = extractExtension(metadata.fileName);
     if (!ext || !options.accept.includes(ext)) {
       return `invalid_file_type: ".${ext}" is not in [${options.accept.join(", ")}]`;
     }
-    // Extension passed the whitelist — now make sure the client-reported
-    // mimeType is consistent with that extension. Guards against MIME-spoofing:
-    // an attacker can't claim extension=jpg while actually uploading PDF bytes
-    // and having the mimeType reflect that.
-    const allowedMimes = EXTENSION_MIME_WHITELIST[ext];
+    // Cheap metadata pre-check only: the client/runtime mimeType is no
+    // evidence of file content (Bun derives it from the filename itself).
+    const allowedMimes = lookupExtensionWhitelist(ext);
     if (allowedMimes && metadata.mimeType) {
       const normalized = normalizeMimeType(metadata.mimeType);
-      if (!allowedMimes.includes(normalized)) {
+      const isAliasedMime = lookupMimeAlias(ext, normalized) !== undefined;
+      if (!allowedMimes.includes(normalized) && !isAliasedMime) {
         return `mime_mismatch: extension ".${ext}" does not match mimeType "${metadata.mimeType}"`;
       }
     }
@@ -185,17 +209,52 @@ export function validateFile(
   return null;
 }
 
+function signatureMimeTypesForExtension(ext: string): readonly string[] {
+  const whitelist = lookupExtensionWhitelist(ext);
+  if (!whitelist) return [];
+  return whitelist.filter((candidate) =>
+    MAGIC_BYTE_SIGNATURES.some((signature) => signature.mimeType === candidate),
+  );
+}
+
 // Separate from validateFile: metadata is known before the upload body is
 // fully read, content-verification only after — callers reject early on
 // metadata without buffering bytes they'll then have to reject anyway.
-export function validateFileContent(mimeType: string, content: Uint8Array): string | null {
-  const normalizedDeclared = normalizeMimeType(mimeType);
-  if (!CONTENT_VERIFIED_MIME_TYPES.has(normalizedDeclared)) return null;
-  const signature = MAGIC_BYTE_SIGNATURES.find((s) => s.mimeType === normalizedDeclared);
-  if (signature && !signature.matches(content)) {
-    return `content_mismatch: bytes do not match declared mimeType "${mimeType}"`;
+export function validateFileContent(fileName: string, content: Uint8Array): string | null {
+  const ext = extractExtension(fileName);
+  if (!ext) return null;
+  const signatureMimeTypes = signatureMimeTypesForExtension(ext);
+  if (signatureMimeTypes.length === 0) return null;
+  const sniffed = sniffMimeType(content);
+  if (sniffed && signatureMimeTypes.includes(sniffed)) return null;
+  return `content_mismatch: ".${ext}" upload bytes are ${sniffed ?? "unrecognized"}, expected ${signatureMimeTypes.join(" or ")}`;
+}
+
+export type UploadMimeTypeResolution =
+  | { readonly kind: "ok"; readonly mimeType: string }
+  | { readonly kind: "rejected"; readonly error: string };
+
+/**
+ * Rewrites an aliased declared mimeType to its canonical form and, in the
+ * same call, sniffs the bytes — a renamed binary (a real .xls/.xlsx saved
+ * as .csv) must fail here rather than through an optional, skippable step.
+ */
+export function resolveUploadMimeType(
+  fileName: string,
+  declaredMimeType: string,
+  content: Uint8Array,
+): UploadMimeTypeResolution {
+  const ext = extractExtension(fileName);
+  const normalizedDeclared = normalizeMimeType(declaredMimeType);
+  const canonical = ext ? lookupMimeAlias(ext, normalizedDeclared) : undefined;
+  if (!canonical) return { kind: "ok", mimeType: declaredMimeType };
+  if (sniffMimeType(content) !== null) {
+    return {
+      kind: "rejected",
+      error: `content_mismatch: bytes of ".${ext}" upload declared as "${declaredMimeType}" are a binary format`,
+    };
   }
-  return null;
+  return { kind: "ok", mimeType: canonical };
 }
 
 export function assertSafeStorageKey(key: string): void {

package/src/jobs/__tests__/job-backoff.integration.test.ts

@@ -14,7 +14,6 @@ import * as z from "zod";
 import { defineFeature } from "../../engine";
 import { setupTestStack, type TestStack, TestUsers } from "../../stack";
 import { waitFor } from "../../testing";
-import { generateId } from "../../utils";
 
 const exponentialDefaultStarts: number[] = [];
 const exponentialCustomStarts: number[] = [];
@@ -92,10 +91,7 @@ let stack: TestStack;
 beforeAll(async () => {
   stack = await setupTestStack({
     features: [backoffFixtureFeature],
-    // Own queue namespace: the default "kumiko-jobs" queue on the shared test
-    // Redis is consumed by every parallel test process, and a foreign worker
-    // grabbing a promoted delayed retry fails it as "Unknown job".
-    jobs: { consumerLane: "worker", queueNamePrefix: `backoff-test-${generateId()}` },
+    jobs: { consumerLane: "worker" },
   });
 });
 

package/src/pipeline/system-hooks.ts

@@ -468,7 +468,8 @@ export async function buildSearchDocument(
 //    die auf optimistic-update setzen merken das nicht; strictly-waiting
 //    Clients müssten poll-after-write.
 //
-// Tests drain deterministisch via `await stack.eventDispatcher.runOnce()`.
+// Tests drain deterministically via `await stack.eventDispatcher.runOnce()`,
+// or via `drainEventConsumers` for this consumer name specifically.
 export const SSE_BROADCAST_CONSUMER_NAME = "system:consumer:sse-broadcast";
 
 export function createSseBroadcastEventConsumer(sseBroker: SseBroker): EventConsumer {