@johnnyboy11234/esg-idea-contest 0.3.0 → 0.3.2

package/frontend/src/shared/api/types.generated.ts

@@ -21,6 +21,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/auth/login": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Log in with employee ID and password (issues a new session)
+         * @description Sets the session cookie and returns the caller. Unknown, malformed and disabled accounts and wrong passwords all answer the same 401. The CSRF token changes with the session, so the client refetches it.
+         */
+        post: operations["login"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/auth/logout": {
         parameters: {
             query?: never;
@@ -38,6 +58,43 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/auth/me": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** The caller (also the idle-timeout "continue" call) */
+        get: operations["getMe"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/auth/register": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Self-service registration (no session is created)
+         * @description Validation order: format, password policy, uniqueness (PRD 6.3). Sets no cookie.
+         */
+        post: operations["register"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/deadline": {
         parameters: {
             query?: never;
@@ -65,7 +122,11 @@ export interface paths {
         /** List Ideas visible to the caller */
         get: operations["listIdeas"];
         put?: never;
-        post?: never;
+        /**
+         * Create an Idea with its slides (User only)
+         * @description One atomic multipart request (PRD 6.6). Order: role 403, state 403, 400 (missing or repeated part), 422 text fields (incl. FILENAME_TOO_LONG), file 413 / 422 EMPTY_FILE / 415 / 422 FILENAME_MISMATCH, 409 IDEA_DUPLICATE, then upload (503 STORAGE_UNAVAILABLE). A transaction whose outcome is unknown answers 503 SERVICE_UNAVAILABLE (the Idea may exist). The Leader is the caller; any leader value in the form is ignored. The body is read by the handler, so the generated wrapper does not bind it.
+         */
+        post: operations["createIdea"];
         delete?: never;
         options?: never;
         head?: never;
@@ -89,6 +150,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/ideas/{id}/slides": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Download the Idea's slides (Leader, Member, Admin)
+         * @description The SLIDES_DOWNLOAD audit row is committed before the first byte is sent (PRD 6.11). The file is named by the current expected filename (PRD 6.6). Range is not supported; HEAD answers 405 (no audit row). The Accept header is not checked on this route. MinIO unavailable before the first byte answers 503 STORAGE_UNAVAILABLE; a storage failure after the headers are sent aborts the connection (the body is shorter than Content-Length). A transaction whose outcome is unknown answers 503 SERVICE_UNAVAILABLE and serves nothing.
+         */
+        get: operations["downloadSlides"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -96,6 +177,35 @@ export interface components {
         CsrfTokenResponse: {
             token: string;
         };
+        LoginRequest: {
+            /** @description Any string; a badly formatted ID is an ordinary login failure */
+            empNo: string;
+            /** Format: password */
+            password: string;
+        };
+        LoginResponse: {
+            empNo: string;
+            name: string;
+            /** @description null for Admin */
+            email: string | null;
+            /** @enum {string} */
+            role: "USER" | "ADMIN";
+        };
+        RegisterRequest: {
+            /** @description Exactly 6 ASCII digits */
+            empNo: string;
+            /** @description 1-50 code points after clean-up */
+            name: string;
+            /** @description Printable ASCII with exactly one @, at most 254 characters; stored lower-cased */
+            email: string;
+            /** Format: password */
+            password: string;
+        };
+        RegisterResponse: {
+            empNo: string;
+            name: string;
+            email: string;
+        };
         Problem: {
             /** @example about:blank */
             type: string;
@@ -112,6 +222,8 @@ export interface components {
             field: string;
             code: string;
             expected?: string;
+            /** @description PASSWORD_POLICY only, the violated rule id (PRD 6.4) */
+            rule?: string;
         };
         Deadline: {
             /** Format: date-time */
@@ -128,6 +240,23 @@ export interface components {
             empNo: string;
             name: string;
         };
+        CreateIdeaForm: {
+            /** @description COOL_IDEA or OUTSTANDING_IMPACT */
+            category: string;
+            /** @description AAID, BSID, ICSD, TSID, PLED or DEID */
+            org: string;
+            /** @description One of the five ESG directions (PRD 6.6) */
+            direction: string;
+            /** @description 1-75 code points after clean-up; no / \ : * ? " < > | */
+            name: string;
+            /** @description 1-300 code points after clean-up */
+            summary: string;
+            /**
+             * Format: binary
+             * @description One PDF or PPTX, at most 5 MiB, named {I|O}_{org}_{leaderName}_{leaderEmpNo}_{name}.{pdf|pptx}
+             */
+            slides: string;
+        };
         IdeaSummary: {
             /** Format: uuid */
             id: string;
@@ -235,6 +364,53 @@ export interface operations {
             500: components["responses"]["Problem"];
         };
     };
+    login: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Session-bound token from GET /auth/csrf. Mandatory on every write, but enforced by the CSRF middleware (403 CSRF_INVALID), so the generated wrapper must not reject its absence first (400). */
+                "X-CSRF-Token"?: components["parameters"]["CsrfToken"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["LoginRequest"];
+            };
+        };
+        responses: {
+            /** @description Logged in */
+            200: {
+                headers: {
+                    /** @description __Host-session=<opaque ID>; HttpOnly; Secure; SameSite=Lax; Path=/ */
+                    "Set-Cookie"?: string;
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LoginResponse"];
+                };
+            };
+            400: components["responses"]["Problem"];
+            401: components["responses"]["Problem"];
+            403: components["responses"]["Problem"];
+            413: components["responses"]["Problem"];
+            415: components["responses"]["Problem"];
+            /** @description Throttled (LOGIN_THROTTLED) */
+            429: {
+                headers: {
+                    /** @description Seconds until a new attempt may succeed */
+                    "Retry-After"?: number;
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            500: components["responses"]["Problem"];
+            503: components["responses"]["Problem"];
+        };
+    };
     logout: {
         parameters: {
             query?: never;
@@ -258,6 +434,63 @@ export interface operations {
             500: components["responses"]["Problem"];
         };
     };
+    getMe: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The authenticated caller */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LoginResponse"];
+                };
+            };
+            401: components["responses"]["Problem"];
+            500: components["responses"]["Problem"];
+        };
+    };
+    register: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Session-bound token from GET /auth/csrf. Mandatory on every write, but enforced by the CSRF middleware (403 CSRF_INVALID), so the generated wrapper must not reject its absence first (400). */
+                "X-CSRF-Token"?: components["parameters"]["CsrfToken"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["RegisterRequest"];
+            };
+        };
+        responses: {
+            /** @description Account created; log in separately */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["RegisterResponse"];
+                };
+            };
+            400: components["responses"]["Problem"];
+            403: components["responses"]["Problem"];
+            409: components["responses"]["Problem"];
+            413: components["responses"]["Problem"];
+            415: components["responses"]["Problem"];
+            422: components["responses"]["Problem"];
+            500: components["responses"]["Problem"];
+            503: components["responses"]["Problem"];
+        };
+    };
     getDeadline: {
         parameters: {
             query?: never;
@@ -285,6 +518,21 @@ export interface operations {
             query?: {
                 page?: number;
                 size?: number;
+                /** @description Closed set; an invalid value is 422 INVALID_ENUM (never ignored). Validated in the handler. */
+                org?: string;
+                category?: string;
+                direction?: string;
+                leaderEmpNo?: string;
+                /** @description ISO 8601 instant with offset or Z; inclusive. Validated in the handler. */
+                createdFrom?: string;
+                /** @description ISO 8601 instant with offset or Z; exclusive. Validated in the handler. */
+                createdTo?: string;
+                /** @description Case-insensitive "name contains"; `%` and `_` are literal. */
+                q?: string;
+                /** @description createdAt (default) or name; anything else is 422 INVALID_ENUM. Validated in the handler. */
+                sort?: string;
+                /** @description asc or desc (default desc for createdAt, asc for name); anything else is 422 INVALID_ENUM. Validated in the handler. */
+                order?: string;
             };
             header?: never;
             path?: never;
@@ -306,6 +554,43 @@ export interface operations {
             500: components["responses"]["Problem"];
         };
     };
+    createIdea: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Session-bound token from GET /auth/csrf. Mandatory on every write, but enforced by the CSRF middleware (403 CSRF_INVALID), so the generated wrapper must not reject its absence first (400). */
+                "X-CSRF-Token"?: components["parameters"]["CsrfToken"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "multipart/form-data": components["schemas"]["CreateIdeaForm"];
+            };
+        };
+        responses: {
+            /** @description Created; Location is /api/v1/ideas/{id} */
+            201: {
+                headers: {
+                    Location?: string;
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IdeaDetail"];
+                };
+            };
+            400: components["responses"]["Problem"];
+            401: components["responses"]["Problem"];
+            403: components["responses"]["Problem"];
+            409: components["responses"]["Problem"];
+            413: components["responses"]["Problem"];
+            415: components["responses"]["Problem"];
+            422: components["responses"]["Problem"];
+            500: components["responses"]["Problem"];
+            503: components["responses"]["Problem"];
+        };
+    };
     getIdea: {
         parameters: {
             query?: never;
@@ -332,4 +617,37 @@ export interface operations {
             500: components["responses"]["Problem"];
         };
     };
+    downloadSlides: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description A malformed ID answers the uniform 404, not 400. */
+                id: components["parameters"]["IdeaId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The stored file */
+            200: {
+                headers: {
+                    /** @description attachment; filename="<ASCII fallback>"; filename*=UTF-8''<percent-encoded> (RFC 6266) */
+                    "Content-Disposition"?: string;
+                    "Content-Length"?: number;
+                    "Cache-Control"?: "no-store";
+                    "X-Content-Type-Options"?: "nosniff";
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/pdf": string;
+                    "application/vnd.openxmlformats-officedocument.presentationml.presentation": string;
+                };
+            };
+            401: components["responses"]["Problem"];
+            404: components["responses"]["Problem"];
+            500: components["responses"]["Problem"];
+            503: components["responses"]["Problem"];
+        };
+    };
 }

package/frontend/src/shared/i18n/locales/en.ts

@@ -56,14 +56,38 @@ export const en = {
     members: 'Members',
     leaderEmpNo: 'Leader employee ID',
   },
+  // Working drafts until the owner supplies official labels and Org full names (OI-17).
+  enums: {
+    category: { COOL_IDEA: 'Cool Idea Award', OUTSTANDING_IMPACT: 'Outstanding Impact Award' },
+    org: { AAID: 'AAID', BSID: 'BSID', ICSD: 'ICSD', TSID: 'TSID', PLED: 'PLED', DEID: 'DEID' },
+    direction: {
+      GREEN_MANUFACTURING: 'Green Manufacturing',
+      RESPONSIBLE_SUPPLY_CHAIN: 'Building a Responsible Supply Chain',
+      INCLUSIVE_WORKPLACE: 'Creating a Healthy and Inclusive Workplace',
+      TALENT_DEVELOPMENT: 'Talent Development',
+      CARING_FOR_DISADVANTAGED: 'Caring for the Disadvantaged',
+    },
+  },
+  passwordRules: {
+    title: 'Your password must:',
+    LENGTH: 'be 12–64 characters long',
+    CHARSET: 'use only printable ASCII characters (no accents, CJK, emoji or tabs)',
+    COMPLEXITY: 'contain at least 3 of: upper case, lower case, digit, symbol (space counts)',
+    COMMON_PASSWORD: 'not be one of the 10,000 most common passwords',
+    KEYBOARD_RUN: 'not contain 4 or more adjacent keyboard keys (qwer, asdf, 1234)',
+    SEQUENCE: 'not contain 4 or more letters or digits in sequence (abcd, 4321)',
+    REPEAT: 'not repeat a character 3 or more times in a row (aaa)',
+    CONTAINS_EMP_NO: 'not contain your employee ID',
+    status: { met: 'met', unmet: 'not met', idle: 'not checked yet', server: 'checked when you submit' },
+  },
   pages: {
-    login: { title: 'Sign in to your account', description: 'Enter your employee ID and password.', noAccount: 'No account yet?', panelTitle: 'ESG Idea Contest', panelBody: 'Register, form a team and submit your Idea.', submitting: 'Signing in…', sessionEnded: 'Your session has ended. Please sign in again.' },
+    idle: { title: 'Are you still there?', body: 'You have been inactive for a while. For your security your session will end in about 2 minutes unless you continue.', continue: 'Continue' },
+    login: { title: 'Sign in to your account', description: 'Enter your employee ID and password.', noAccount: 'No account yet?', panelTitle: 'ESG Idea Contest', panelBody: 'Register, form a team and submit your Idea.', submitting: 'Signing in…', retryIn: 'Try again in {{seconds}} s', canRetry: 'You can sign in again.', sessionEnded: 'Your session has ended. Please sign in again.' },
     register: {
       title: 'Create an account',
       description: 'Enter your details below to register.',
       empNoHint: '6 digits.',
       emailHint: 'Letters, digits and symbols only, no spaces.',
-      passwordHint: '12–64 printable ASCII characters, with at least 3 of: upper case, lower case, digit, symbol.',
       mismatch: 'The passwords do not match.',
       haveAccount: 'Already registered?',
       submit: 'Create account',
@@ -72,8 +96,26 @@ export const en = {
       success: 'Your account was created. Sign in to continue.',
     },
     ideaList: { search: 'Search', apply: 'Apply filters', create: 'Create an Idea', empty: 'No Ideas yet.' },
-    ideaForm: { slidesHint: 'PDF or PPTX, up to 5 MiB.' },
-    ideaCreate: { title: 'Create an Idea', submit: 'Submit Idea' },
+    ideaForm: {
+      slidesHint: 'PDF or PPTX, up to 5 MiB, named exactly as shown above.',
+      choose: 'Choose…',
+      leaderHint: 'You are the Leader of the Idea you create.',
+      nameHint: 'The characters / \\ : * ? " < > | are not allowed.',
+      count: '{{n}} / {{max}} characters',
+      expectedTitle: 'Expected file name',
+      expectedPending: 'Choose a category and an organization and enter the Idea name to see the expected file name.',
+      expectedHint: 'Name your slide file exactly like this before you choose it. The file is not renamed for you.',
+      copy: 'Copy the {{ext}} file name',
+      copied: 'File name copied.',
+      copyFailed: 'The file name could not be copied. Select it and copy it by hand.',
+      expectedIs: 'Expected: {{name}}',
+    },
+    ideaCreate: {
+      title: 'Create an Idea',
+      submit: 'Submit Idea',
+      submitting: 'Submitting…',
+      closedHint: 'Submissions are not open, so the Idea cannot be submitted now.',
+    },
     ideaEdit: { title: 'Edit Idea' },
     ideaDetail: {
       title: 'Idea',

package/frontend/src/shared/i18n/locales/zh-TW.ts

@@ -53,14 +53,38 @@ export const zhTW: Dictionary = {
     members: '成員',
     leaderEmpNo: '組長員工編號',
   },
+  // 正式名稱由負責人提供前的暫定標籤（OI-17）。
+  enums: {
+    category: { COOL_IDEA: '酷點子獎', OUTSTANDING_IMPACT: '卓越影響獎' },
+    org: { AAID: 'AAID', BSID: 'BSID', ICSD: 'ICSD', TSID: 'TSID', PLED: 'PLED', DEID: 'DEID' },
+    direction: {
+      GREEN_MANUFACTURING: '綠色製造',
+      RESPONSIBLE_SUPPLY_CHAIN: '打造負責任供應鏈',
+      INCLUSIVE_WORKPLACE: '營造健康共融職場',
+      TALENT_DEVELOPMENT: '人才培育',
+      CARING_FOR_DISADVANTAGED: '關懷弱勢',
+    },
+  },
+  passwordRules: {
+    title: '密碼必須：',
+    LENGTH: '長度為 12–64 個字元',
+    CHARSET: '僅使用可列印的 ASCII 字元（不可含重音字母、中日韓文字、表情符號或 Tab）',
+    COMPLEXITY: '至少包含大寫、小寫、數字、符號其中 3 類（空白算符號）',
+    COMMON_PASSWORD: '不可是最常見的 10,000 個密碼之一',
+    KEYBOARD_RUN: '不可包含 4 個以上相鄰的鍵盤按鍵（qwer、asdf、1234）',
+    SEQUENCE: '不可包含 4 個以上連續的字母或數字（abcd、4321）',
+    REPEAT: '同一字元不可連續出現 3 次以上（aaa）',
+    CONTAINS_EMP_NO: '不可包含您的員工編號',
+    status: { met: '已符合', unmet: '未符合', idle: '尚未檢查', server: '送出時檢查' },
+  },
   pages: {
-    login: { title: '登入您的帳號', description: '請輸入員工編號與密碼。', noAccount: '還沒有帳號？', panelTitle: 'ESG 創意競賽', panelBody: '註冊、組隊並提交您的創意。', submitting: '登入中…', sessionEnded: '您的登入已結束，請重新登入。' },
+    idle: { title: '您還在嗎？', body: '您已閒置一段時間。為了安全，若不繼續使用，您的登入將在約 2 分鐘後結束。', continue: '繼續' },
+    login: { title: '登入您的帳號', description: '請輸入員工編號與密碼。', noAccount: '還沒有帳號？', panelTitle: 'ESG 創意競賽', panelBody: '註冊、組隊並提交您的創意。', submitting: '登入中…', retryIn: '{{seconds}} 秒後可再試', canRetry: '您可以再次登入。', sessionEnded: '您的登入已結束，請重新登入。' },
     register: {
       title: '建立帳號',
       description: '請在下方輸入資料以完成註冊。',
       empNoHint: '6 位數字。',
       emailHint: '僅限英數字與符號，不可包含空白。',
-      passwordHint: '12–64 個可列印 ASCII 字元，且至少包含大寫、小寫、數字、符號其中 3 類。',
       mismatch: '兩次輸入的密碼不一致。',
       haveAccount: '已經註冊？',
       submit: '建立帳號',
@@ -69,8 +93,26 @@ export const zhTW: Dictionary = {
       success: '帳號已建立，請登入。',
     },
     ideaList: { search: '搜尋', apply: '套用篩選', create: '建立提案', empty: '目前沒有提案。' },
-    ideaForm: { slidesHint: 'PDF 或 PPTX，最大 5 MiB。' },
-    ideaCreate: { title: '建立提案', submit: '送出提案' },
+    ideaForm: {
+      slidesHint: 'PDF 或 PPTX，最大 5 MiB，檔名須與上方完全相同。',
+      choose: '請選擇…',
+      leaderHint: '您將成為所建立提案的組長。',
+      nameHint: '不可包含 / \\ : * ? " < > | 等字元。',
+      count: '{{n}} / {{max}} 字',
+      expectedTitle: '應使用的檔名',
+      expectedPending: '選擇獎項類別與單位並輸入提案名稱後，即會顯示應使用的檔名。',
+      expectedHint: '請在選擇檔案前，將簡報檔案命名為下列名稱。系統不會自動為您改名。',
+      copy: '複製 {{ext}} 檔名',
+      copied: '已複製檔名。',
+      copyFailed: '無法複製檔名，請手動選取後複製。',
+      expectedIs: '應為：{{name}}',
+    },
+    ideaCreate: {
+      title: '建立提案',
+      submit: '送出提案',
+      submitting: '送出中…',
+      closedHint: '目前不在收件期間，暫時無法送出提案。',
+    },
     ideaEdit: { title: '編輯提案' },
     ideaDetail: {
       title: '提案',

package/frontend/src/shared/slides/index.ts

@@ -0,0 +1,74 @@
+// Slide rules of PRD §6.8 (Frontend.md §5.5). The back end implements the same
+// rules (backend/internal/storage); both run testdata/expected-filename.json.
+// The server is the final judge: this is a pre-check that saves a doomed upload.
+
+export const CATEGORIES = ['COOL_IDEA', 'OUTSTANDING_IMPACT'] as const;
+export type Category = (typeof CATEGORIES)[number];
+
+/** 5 MiB, inclusive (PRD §6.8). */
+export const MAX_SLIDES_BYTES = 5 * 1024 * 1024;
+/** The longest expected filename in UTF-8 bytes (PRD §6.2), measured with `.pptx`. */
+export const MAX_FILENAME_BYTES = 255;
+const LONGEST_EXT = '.pptx';
+
+export const SLIDE_EXTS = ['pdf', 'pptx'] as const;
+export type SlideExt = (typeof SLIDE_EXTS)[number];
+
+/**
+ * `{I|O}_{org}_{leaderName}_{leaderEmpNo}_{ideaName}` without extension, by plain
+ * concatenation, NFC-normalized. Inputs are the cleaned values.
+ */
+export function expectedFilenameBase(category: Category, org: string, leaderName: string, leaderEmpNo: string, ideaName: string): string {
+  const prefix = category === 'COOL_IDEA' ? 'I' : 'O';
+  return `${prefix}_${org}_${leaderName}_${leaderEmpNo}_${ideaName}`.normalize('NFC');
+}
+
+export function utf8Bytes(s: string): number {
+  return new TextEncoder().encode(s).length;
+}
+
+/** True when base + `.pptx` exceeds 255 UTF-8 bytes → `FILENAME_TOO_LONG` (PRD §6.6). */
+export function filenameTooLong(base: string): boolean {
+  return utf8Bytes(base + LONGEST_EXT) > MAX_FILENAME_BYTES;
+}
+
+export type SlidesProblem = '' | 'REQUIRED' | 'FILE_TOO_LARGE' | 'EMPTY_FILE' | 'UNSUPPORTED_FILE_TYPE' | 'FILENAME_MISMATCH';
+
+/** The part after the last dot, lower-cased; '' when there is none. */
+function extOf(name: string): string {
+  const dot = name.lastIndexOf('.');
+  return dot < 0 ? '' : name.slice(dot + 1).toLowerCase();
+}
+
+const PDF_MAGIC = [0x25, 0x50, 0x44, 0x46, 0x2d]; // %PDF-
+const ZIP_MAGIC = [0x50, 0x4b, 0x03, 0x04]; // PK\3\4
+
+const startsWith = (b: Uint8Array, magic: number[]) => magic.every((m, i) => b[i] === m);
+
+async function head(file: Blob, n: number): Promise<Uint8Array> {
+  return new Uint8Array(await file.slice(0, n).arrayBuffer());
+}
+
+/**
+ * Pre-check in the server's order (PRD §6.8): count, size, not empty, magic bytes
+ * with an agreeing extension, filename. Stops at the first failing step.
+ * `expectedBase` is null while the text fields cannot produce one; the filename
+ * step is then skipped (the server does not validate the file when text is invalid).
+ *
+ * The client only checks the ZIP signature for a PPTX; the central directory
+ * check stays with the server.
+ */
+export async function precheckSlides(files: readonly File[], expectedBase: string | null): Promise<SlidesProblem> {
+  if (files.length !== 1) return 'REQUIRED';
+  const file = files[0]!;
+  if (file.size > MAX_SLIDES_BYTES) return 'FILE_TOO_LARGE';
+  if (file.size === 0) return 'EMPTY_FILE';
+  const name = file.name.normalize('NFC');
+  const ext = extOf(name);
+  const bytes = await head(file, PDF_MAGIC.length);
+  const typeOk = (ext === 'pdf' && startsWith(bytes, PDF_MAGIC)) || (ext === 'pptx' && startsWith(bytes, ZIP_MAGIC));
+  if (!typeOk) return 'UNSUPPORTED_FILE_TYPE';
+  if (expectedBase === null) return '';
+  const base = name.slice(0, name.length - ext.length - 1);
+  return base === expectedBase.normalize('NFC') ? '' : 'FILENAME_MISMATCH';
+}

package/frontend/src/shared/slides/slides.test.ts

@@ -0,0 +1,51 @@
+import fixture from 'testdata/expected-filename.json';
+import { expectedFilenameBase, filenameTooLong, MAX_SLIDES_BYTES, precheckSlides, utf8Bytes, type Category } from './index';
+
+describe('expectedFilenameBase (testdata/expected-filename.json)', () => {
+  it.each(fixture.cases.map((c) => [c.id, c] as const))('%s', (_id, c) => {
+    const base = expectedFilenameBase(c.category as Category, c.org, c.leaderName, c.leaderEmpNo, c.ideaName);
+    expect(base).toBe(c.wantBase);
+    expect(utf8Bytes(base + '.pptx')).toBe(c.wantBytes);
+    expect(filenameTooLong(base)).toBe(c.wantTooLong);
+  });
+});
+
+const PDF = '%PDF-1.7\n';
+const ZIP = 'PK\u0003\u0004rest';
+const BASE = 'I_BSID_王小明_089290_成立供應商永續學院';
+
+const file = (name: string, content: string | Uint8Array = PDF) => new File([content as BlobPart], name);
+
+describe('precheckSlides (PRD §6.8 order)', () => {
+  it.each([
+    ['no file', [], 'REQUIRED'],
+    ['two files', [file(`${BASE}.pdf`), file(`${BASE}.pdf`)], 'REQUIRED'],
+    ['empty', [file(`${BASE}.pdf`, '')], 'EMPTY_FILE'],
+    ['PDF bytes, .pptx name', [file(`${BASE}.pptx`)], 'UNSUPPORTED_FILE_TYPE'],
+    ['ZIP bytes, .pdf name', [file(`${BASE}.pdf`, ZIP)], 'UNSUPPORTED_FILE_TYPE'],
+    ['.docx', [file(`${BASE}.docx`, ZIP)], 'UNSUPPORTED_FILE_TYPE'],
+    ['no extension', [file(BASE)], 'UNSUPPORTED_FILE_TYPE'],
+    ['wrong name', [file('slides.pdf')], 'FILENAME_MISMATCH'],
+    ['name with a path', [file(`dir/${BASE}.pdf`)], 'FILENAME_MISMATCH'],
+    ['PDF ok', [file(`${BASE}.pdf`)], ''],
+    ['PPTX ok, upper-case extension', [file(`${BASE}.PPTX`, ZIP)], ''],
+    ['NFD filename (macOS) matches', [file('I_ICSD_Zoe_000002_Café.pdf')], ''],
+  ] as const)('%s → %j', async (_n, files, want) => {
+    const base = files[0]?.name.startsWith('I_ICSD') ? 'I_ICSD_Zoe_000002_Café' : BASE;
+    expect(await precheckSlides(files, base)).toBe(want);
+  });
+
+  it('size is checked before emptiness and type; 5 MiB is allowed', async () => {
+    const big = file(`${BASE}.pdf`);
+    Object.defineProperty(big, 'size', { value: MAX_SLIDES_BYTES + 1 });
+    expect(await precheckSlides([big], BASE)).toBe('FILE_TOO_LARGE');
+    const exact = new File([PDF, new Uint8Array(MAX_SLIDES_BYTES - PDF.length)], `${BASE}.pdf`);
+    expect(exact.size).toBe(MAX_SLIDES_BYTES);
+    expect(await precheckSlides([exact], BASE)).toBe('');
+  });
+
+  it('skips the filename step while no expected name exists', async () => {
+    expect(await precheckSlides([file('anything.pdf')], null)).toBe('');
+    expect(await precheckSlides([file('anything.pptx')], null)).toBe('UNSUPPORTED_FILE_TYPE');
+  });
+});