From b815338578d82c331699df0b67976c4a374a5f9a Mon Sep 17 00:00:00 2001
From: FairBid <fairbid01@gmail.com>
Date: Wed, 26 Aug 2026 17:20:41 +0000
Subject: [PATCH] feat: enforce attachment validation (type, size, filename,
 malware hook)

- Add attachmentValidation.ts with MIME allowlist (PDF only), 10 MB
  size limit, filename sanitization (path traversal, null bytes, HTML
  injection, length), PDF magic-byte check, and a swappable malware-
  scan hook for server-side use
- Wire UploadModal.tsx to validateAttachment() on both file-input
  change and drag-and-drop; show rejection reason in role=alert region
- Add /api/attachments/validate route that re-runs the full server-side
  validator (magic bytes + MIME + size + filename + malware stub) via
  busboy multipart parsing
- Add 65 unit/component tests covering success, failure, boundary, and
  ordering cases across both client and server validators
---
 .../LabResults/UploadModal.test.tsx           | 222 +++++++++++
 src/components/LabResults/UploadModal.tsx     | 151 +++++---
 src/pages/api/attachments/validate.ts         | 205 +++++++++++
 src/utils/attachmentValidation.test.ts        | 345 ++++++++++++++++++
 src/utils/attachmentValidation.ts             | 246 +++++++++++++
 5 files changed, 1127 insertions(+), 42 deletions(-)
 create mode 100644 src/components/LabResults/UploadModal.test.tsx
 create mode 100644 src/pages/api/attachments/validate.ts
 create mode 100644 src/utils/attachmentValidation.test.ts
 create mode 100644 src/utils/attachmentValidation.ts

diff --git a/src/components/LabResults/UploadModal.test.tsx b/src/components/LabResults/UploadModal.test.tsx
new file mode 100644
index 000000000..dfbd9f19a
--- /dev/null
+++ b/src/components/LabResults/UploadModal.test.tsx
@@ -0,0 +1,222 @@
+/**
+ * UploadModal – attachment validation tests
+ *
+ * RED suite: exercises validation rules that were absent in the original
+ * implementation. These tests will fail against the unmodified component
+ * and pass once the fix lands.
+ */
+import { render, screen, fireEvent, waitFor } from '@testing-library/react';
+import React from 'react';
+
+import UploadModal from './UploadModal';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** Build a synthetic File without triggering real I/O. */
+function makeFile(name: string, size: number, type: string): File {
+  const content = new Uint8Array(size);
+  return new File([content], name, { type });
+}
+
+const PDF_1MB = makeFile('report.pdf', 1 * 1024 * 1024, 'application/pdf');
+const PDF_OVER_LIMIT = makeFile('big.pdf', 11 * 1024 * 1024, 'application/pdf');
+const PDF_EXACT_LIMIT = makeFile('exact.pdf', 10 * 1024 * 1024, 'application/pdf');
+const PNG_FILE = makeFile('image.png', 500 * 1024, 'image/png');
+const EXEC_FILE = makeFile('malware.exe', 100, 'application/octet-stream');
+const DISGUISED_FILE = makeFile('report.pdf', 100, 'application/x-executable');
+const DIRTY_FILENAME = makeFile('../../../etc/passwd', 1024, 'application/pdf');
+const LONG_FILENAME = makeFile('a'.repeat(256) + '.pdf', 1024, 'application/pdf');
+const SCRIPT_FILENAME = makeFile('<script>alert(1)</script>.pdf', 1024, 'application/pdf');
+
+function getFileInput(): HTMLInputElement {
+  // The hidden file input is identified by its id
+  return document.getElementById('file-upload') as HTMLInputElement;
+}
+
+// ---------------------------------------------------------------------------
+// Rendering helper
+// ---------------------------------------------------------------------------
+function renderModal() {
+  const onClose = jest.fn();
+  const utils = render(<UploadModal onClose={onClose} />);
+  return { onClose, ...utils };
+}
+
+// ---------------------------------------------------------------------------
+// RED tests – these characterise MISSING behaviour
+// ---------------------------------------------------------------------------
+
+describe('UploadModal – file type validation', () => {
+  it('rejects a PNG file with an accessible error message', async () => {
+    renderModal();
+    fireEvent.change(getFileInput(), { target: { files: [PNG_FILE] } });
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toBeInTheDocument();
+    });
+    expect(screen.getByRole('alert')).toHaveTextContent(/pdf/i);
+    // File must NOT be accepted
+    expect(screen.queryByText('report.pdf')).not.toBeInTheDocument();
+  });
+
+  it('rejects an executable disguised as PDF based on MIME type', async () => {
+    renderModal();
+    fireEvent.change(getFileInput(), { target: { files: [EXEC_FILE] } });
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toBeInTheDocument();
+    });
+  });
+
+  it('rejects a file whose MIME type is not in the allowlist even if extension is .pdf', async () => {
+    renderModal();
+    fireEvent.change(getFileInput(), { target: { files: [DISGUISED_FILE] } });
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toBeInTheDocument();
+    });
+  });
+});
+
+describe('UploadModal – file size validation', () => {
+  it('rejects a PDF exceeding the 10 MB limit', async () => {
+    renderModal();
+    fireEvent.change(getFileInput(), { target: { files: [PDF_OVER_LIMIT] } });
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toBeInTheDocument();
+    });
+    expect(screen.getByRole('alert')).toHaveTextContent(/10\s*mb|size|too large/i);
+  });
+
+  it('accepts a PDF that is exactly 10 MB', async () => {
+    renderModal();
+    fireEvent.change(getFileInput(), { target: { files: [PDF_EXACT_LIMIT] } });
+
+    await waitFor(() => {
+      expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+    });
+    // Confirm & Analyse button should now be enabled
+    expect(screen.getByRole('button', { name: /confirm/i })).not.toBeDisabled();
+  });
+
+  it('accepts a valid 1 MB PDF', async () => {
+    renderModal();
+    fireEvent.change(getFileInput(), { target: { files: [PDF_1MB] } });
+
+    await waitFor(() => {
+      expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+    });
+    expect(screen.getByRole('button', { name: /confirm/i })).not.toBeDisabled();
+  });
+});
+
+describe('UploadModal – filename sanitization', () => {
+  it('rejects a path-traversal filename', async () => {
+    renderModal();
+    fireEvent.change(getFileInput(), { target: { files: [DIRTY_FILENAME] } });
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toBeInTheDocument();
+    });
+    expect(screen.getByRole('alert')).toHaveTextContent(/filename|invalid/i);
+  });
+
+  it('rejects a filename that is excessively long', async () => {
+    renderModal();
+    fireEvent.change(getFileInput(), { target: { files: [LONG_FILENAME] } });
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toBeInTheDocument();
+    });
+  });
+
+  it('rejects a filename containing HTML/script injection characters', async () => {
+    renderModal();
+    fireEvent.change(getFileInput(), { target: { files: [SCRIPT_FILENAME] } });
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toBeInTheDocument();
+    });
+  });
+});
+
+describe('UploadModal – accessible error UI', () => {
+  it('error container has role="alert" so screen readers announce it', async () => {
+    renderModal();
+    fireEvent.change(getFileInput(), { target: { files: [PNG_FILE] } });
+
+    await waitFor(() => {
+      const alert = screen.getByRole('alert');
+      expect(alert).toBeInTheDocument();
+    });
+  });
+
+  it('error container is aria-live="assertive" or role="alert" (implicit assertive)', async () => {
+    renderModal();
+    fireEvent.change(getFileInput(), { target: { files: [PNG_FILE] } });
+
+    await waitFor(() => {
+      const alert = screen.getByRole('alert');
+      // role="alert" implies aria-live="assertive"; both are acceptable
+      const live = alert.getAttribute('aria-live');
+      expect(live === null || live === 'assertive' || live === 'polite').toBe(true);
+    });
+  });
+
+  it('clears error when a valid file replaces an invalid one', async () => {
+    renderModal();
+
+    // First trigger an error
+    fireEvent.change(getFileInput(), { target: { files: [PNG_FILE] } });
+    await waitFor(() => expect(screen.getByRole('alert')).toBeInTheDocument());
+
+    // Then pick a valid file
+    fireEvent.change(getFileInput(), { target: { files: [PDF_1MB] } });
+    await waitFor(() => {
+      expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+    });
+  });
+});
+
+describe('UploadModal – drag-and-drop validation', () => {
+  it('rejects a PNG dropped onto the drop zone', async () => {
+    renderModal();
+
+    // Use the container div (parent of the input)
+    const dropArea = document
+      .querySelector('.border-dashed') as HTMLElement;
+
+    fireEvent.drop(dropArea, {
+      dataTransfer: { files: [PNG_FILE] },
+    });
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toBeInTheDocument();
+    });
+  });
+
+  it('rejects an oversized PDF dropped onto the drop zone', async () => {
+    renderModal();
+    const dropArea = document.querySelector('.border-dashed') as HTMLElement;
+
+    fireEvent.drop(dropArea, {
+      dataTransfer: { files: [PDF_OVER_LIMIT] },
+    });
+
+    await waitFor(() => {
+      expect(screen.getByRole('alert')).toBeInTheDocument();
+    });
+    expect(screen.getByRole('alert')).toHaveTextContent(/10\s*mb|size|too large/i);
+  });
+});
+
+describe('UploadModal – loading / empty state', () => {
+  it('shows the upload area when no file is selected', () => {
+    renderModal();
+    expect(screen.getByText(/drag & drop your pdf/i)).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: /confirm/i })).toBeDisabled();
+  });
+});
diff --git a/src/components/LabResults/UploadModal.tsx b/src/components/LabResults/UploadModal.tsx
index cb834467e..2a37c9203 100644
--- a/src/components/LabResults/UploadModal.tsx
+++ b/src/components/LabResults/UploadModal.tsx
@@ -1,10 +1,19 @@
-import React, { useState, useCallback } from 'react';
 import { UploadCloud, File, X, CheckCircle2, AlertCircle } from 'lucide-react';
+import React, { useState, useCallback, useId } from 'react';
+
+
+import {
+  validateAttachment,
+  ALLOWED_EXTENSIONS_LABEL,
+  MAX_FILE_SIZE_BYTES,
+} from '@/utils/attachmentValidation';
 
 interface UploadModalProps {
   onClose: () => void;
 }
 
+const MAX_FILE_SIZE_MB = MAX_FILE_SIZE_BYTES / (1024 * 1024);
+
 export default function UploadModal({ onClose }: UploadModalProps) {
   const [isDragActive, setIsDragActive] = useState(false);
   const [selectedFile, setSelectedFile] = useState<File | null>(null);
@@ -12,6 +21,28 @@ export default function UploadModal({ onClose }: UploadModalProps) {
   const [isSuccess, setIsSuccess] = useState(false);
   const [error, setError] = useState<string | null>(null);
 
+  // Stable id for the error region so the input can reference it via aria-describedby
+  const errorId = useId();
+
+  // ------------------------------------------------------------------
+  // File selection handler – shared by click and drag-and-drop
+  // ------------------------------------------------------------------
+  const handleFile = useCallback((file: File) => {
+    setError(null);
+
+    const result = validateAttachment(file);
+    if (!result.valid) {
+      setError(result.error ?? 'This file cannot be uploaded.');
+      setSelectedFile(null);
+      return;
+    }
+
+    setSelectedFile(file);
+  }, []);
+
+  // ------------------------------------------------------------------
+  // Drag handlers
+  // ------------------------------------------------------------------
   const handleDrag = useCallback((e: React.DragEvent) => {
     e.preventDefault();
     e.stopPropagation();
@@ -22,41 +53,42 @@ export default function UploadModal({ onClose }: UploadModalProps) {
     }
   }, []);
 
-  const handleDrop = useCallback((e: React.DragEvent) => {
-    e.preventDefault();
-    e.stopPropagation();
-    setIsDragActive(false);
-    setError(null);
+  const handleDrop = useCallback(
+    (e: React.DragEvent) => {
+      e.preventDefault();
+      e.stopPropagation();
+      setIsDragActive(false);
 
-    const files = e.dataTransfer.files;
-    if (files && files[0]) {
-      const file = files[0];
-      if (file.type === 'application/pdf') {
-        setSelectedFile(file);
-      } else {
-        setError('Please upload a PDF file.');
+      const files = e.dataTransfer.files;
+      if (files && files[0]) {
+        handleFile(files[0]);
       }
-    }
-  }, []);
+    },
+    [handleFile],
+  );
 
-  const handleFileChange = (e: React.ChangeEvent<HTMLInputElement>) => {
-    setError(null);
-    if (e.target.files && e.target.files[0]) {
-      const file = e.target.files[0];
-      if (file.type === 'application/pdf') {
-        setSelectedFile(file);
-      } else {
-        setError('Please upload a PDF file.');
+  // ------------------------------------------------------------------
+  // Input change handler
+  // ------------------------------------------------------------------
+  const handleFileChange = useCallback(
+    (e: React.ChangeEvent<HTMLInputElement>) => {
+      if (e.target.files && e.target.files[0]) {
+        handleFile(e.target.files[0]);
       }
-    }
-  };
+    },
+    [handleFile],
+  );
 
-  const handleUpload = () => {
+  // ------------------------------------------------------------------
+  // Upload handler (calls the real API in production)
+  // ------------------------------------------------------------------
+  const handleUpload = useCallback(() => {
     if (!selectedFile) return;
     setIsUploading(true);
     setError(null);
 
     // Simulate upload delay and processing
+    // In production: replace with uploadLabReport(petId, selectedFile)
     setTimeout(() => {
       setIsUploading(false);
       setIsSuccess(true);
@@ -64,7 +96,19 @@ export default function UploadModal({ onClose }: UploadModalProps) {
         onClose();
       }, 2000);
     }, 1500);
-  };
+  }, [selectedFile, onClose]);
+
+  // ------------------------------------------------------------------
+  // Derived state for dropzone styling
+  // ------------------------------------------------------------------
+  const dropzoneClass = [
+    'relative border-2 border-dashed rounded-2xl p-8 sm:p-10 text-center transition-all duration-200',
+    isDragActive
+      ? 'border-blue-500 bg-blue-50 scale-[1.02]'
+      : error
+        ? 'border-red-300 bg-red-50'
+        : 'border-gray-200 bg-gray-50 hover:bg-gray-100',
+  ].join(' ');
 
   return (
     <div
@@ -72,11 +116,13 @@ export default function UploadModal({ onClose }: UploadModalProps) {
       role="dialog"
       aria-modal="true"
       aria-labelledby="upload-modal-title"
+      aria-describedby={error ? errorId : undefined}
     >
       <div
         className="bg-white rounded-3xl shadow-2xl p-6 md:p-8 w-full max-w-md relative animate-fade-in"
         role="document"
       >
+        {/* Close button */}
         <button
           onClick={onClose}
           aria-label="Close upload dialog"
@@ -85,15 +131,21 @@ export default function UploadModal({ onClose }: UploadModalProps) {
           <X className="w-6 h-6" aria-hidden="true" />
         </button>
 
+        {/* Title */}
         <h2 id="upload-modal-title" className="text-2xl font-bold text-blue-900 mb-2">
           Upload Results
         </h2>
         <p className="text-gray-600 mb-6 text-sm">
-          Upload your pet&apos;s official lab report PDF to automatically extract and store results
-          securely on the blockchain.
+          Upload your pet&apos;s official lab report {ALLOWED_EXTENSIONS_LABEL} to automatically
+          extract and store results securely on the blockchain.
+          <br />
+          <span className="text-gray-400">
+            Maximum size: {MAX_FILE_SIZE_MB} MB. Only {ALLOWED_EXTENSIONS_LABEL} files accepted.
+          </span>
         </p>
 
         {isSuccess ? (
+          /* ---- Success state ---- */
           <div className="flex flex-col items-center justify-center py-8 text-center animate-fade-in">
             <div className="p-4 bg-green-100 rounded-full mb-4">
               <CheckCircle2 className="w-12 h-12 text-green-500" />
@@ -105,24 +157,24 @@ export default function UploadModal({ onClose }: UploadModalProps) {
           </div>
         ) : (
           <div className="space-y-4">
+            {/* ---- Drop zone ---- */}
             <div
               onDragEnter={handleDrag}
               onDragOver={handleDrag}
               onDragLeave={handleDrag}
               onDrop={handleDrop}
-              className={`relative border-2 border-dashed rounded-2xl p-10 text-center transition-all duration-200 ${
-                isDragActive
-                  ? 'border-blue-500 bg-blue-50 scale-[1.02]'
-                  : 'border-gray-200 bg-gray-50 hover:bg-gray-100'
-              } ${error ? 'border-red-300 bg-red-50' : ''}`}
+              className={dropzoneClass}
             >
               <input
                 type="file"
-                accept=".pdf"
+                accept=".pdf,application/pdf"
                 className="absolute inset-0 w-full h-full opacity-0 cursor-pointer"
                 id="file-upload"
                 onChange={handleFileChange}
                 disabled={isUploading}
+                aria-label="Select a PDF file to upload"
+                aria-describedby={error ? errorId : undefined}
+                aria-invalid={error ? true : undefined}
               />
               <div className="flex flex-col items-center justify-center">
                 {selectedFile ? (
@@ -142,7 +194,7 @@ export default function UploadModal({ onClose }: UploadModalProps) {
                     <div className="p-4 bg-white rounded-2xl shadow-sm mb-4">
                       <UploadCloud className="w-10 h-10 text-blue-500" />
                     </div>
-                    <p className="text-gray-700 font-bold mb-1">Drag & drop your PDF</p>
+                    <p className="text-gray-700 font-bold mb-1">Drag &amp; drop your PDF</p>
                     <p className="text-gray-400 text-xs uppercase tracking-widest font-semibold">
                       or click to browse
                     </p>
@@ -151,14 +203,28 @@ export default function UploadModal({ onClose }: UploadModalProps) {
               </div>
             </div>
 
+            {/* ---- Accessible error region ---- */}
+            {/*
+              role="alert" implies aria-live="assertive", which causes
+              screen readers to announce the message immediately when it
+              appears.  The region is always rendered in the DOM when
+              there is an error so the announcement fires correctly.
+            */}
             {error && (
-              <div className="flex items-center gap-2 text-red-600 text-sm bg-red-50 p-3 rounded-xl border border-red-100">
-                <AlertCircle className="w-4 h-4 shrink-0" />
+              <div
+                id={errorId}
+                role="alert"
+                aria-live="assertive"
+                className="flex items-start gap-2 text-red-600 text-sm bg-red-50 p-3 rounded-xl border border-red-100"
+              >
+                <AlertCircle className="w-4 h-4 shrink-0 mt-0.5" aria-hidden="true" />
                 <p>{error}</p>
               </div>
             )}
 
+            {/* ---- Submit button ---- */}
             <button
+              type="button"
               disabled={!selectedFile || isUploading}
               onClick={handleUpload}
               className={`w-full mt-2 py-4 rounded-2xl font-bold text-white transition-all shadow-md active:scale-[0.98] transform ${
@@ -174,6 +240,7 @@ export default function UploadModal({ onClose }: UploadModalProps) {
                     xmlns="http://www.w3.org/2000/svg"
                     fill="none"
                     viewBox="0 0 24 24"
+                    aria-hidden="true"
                   >
                     <circle
                       className="opacity-25"
@@ -182,14 +249,14 @@ export default function UploadModal({ onClose }: UploadModalProps) {
                       r="10"
                       stroke="currentColor"
                       strokeWidth="4"
-                    ></circle>
+                    />
                     <path
                       className="opacity-75"
                       fill="currentColor"
-                      d="4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
-                    ></path>
+                      d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+                    />
                   </svg>
-                  Uploading...
+                  <span>Uploading…</span>
                 </span>
               ) : (
                 'Confirm & Analyze Report'
diff --git a/src/pages/api/attachments/validate.ts b/src/pages/api/attachments/validate.ts
new file mode 100644
index 000000000..821d43765
--- /dev/null
+++ b/src/pages/api/attachments/validate.ts
@@ -0,0 +1,205 @@
+/**
+ * /api/attachments/validate
+ *
+ * Server-side endpoint that validates a medical attachment before it is
+ * persisted to storage.  Clients POST a multipart/form-data body with a
+ * single `file` field.
+ *
+ * This route acts as the authoritative gate:
+ *  1. MIME-type allowlist check (re-validated server-side)
+ *  2. PDF magic-byte verification (counters MIME spoofing)
+ *  3. File-size limit
+ *  4. Filename sanitization
+ *  5. Malware-scan hook (stub – replace with a real integration)
+ *
+ * Only POST is accepted.  The response is always JSON:
+ *   200  { valid: true }
+ *   400  { valid: false, error: "<reason>" }
+ *   405  Method Not Allowed
+ *   413  { valid: false, error: "..." }
+ *
+ * Dependencies: this route uses the `busboy` package for multipart
+ * parsing.  Install it with:
+ *   npm install busboy@1.6.0
+ *   npm install --save-dev @types/busboy@1.5.4
+ *
+ * If busboy is not yet available in your environment, the route falls
+ * back gracefully and returns a 501 with an actionable message.
+ */
+import type { Readable } from 'stream';
+
+import type { NextApiRequest, NextApiResponse } from 'next';
+
+import {
+  validateAttachmentServer,
+  type ValidationResult,
+  MAX_FILE_SIZE_BYTES,
+} from '@/utils/attachmentValidation';
+
+// Disable Next.js default body parsing so we can read the raw stream.
+export const config = {
+  api: {
+    bodyParser: false,
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Multipart parsing (busboy – optional peer dependency)
+// ---------------------------------------------------------------------------
+
+interface ParsedFile {
+  fieldname: string;
+  filename: string;
+  mimeType: string;
+  /** Complete file content as a Buffer. */
+  data: Buffer;
+}
+
+/**
+ * Parses the first file from a multipart/form-data request using busboy.
+ * Throws if busboy is not installed or if the stream contains no file.
+ */
+async function parseFirstFile(req: NextApiRequest): Promise<ParsedFile> {
+  // Dynamic import so the route fails gracefully when busboy is missing.
+  // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/consistent-type-imports
+  const Busboy = require('busboy') as typeof import('busboy');
+
+  return new Promise((resolve, reject) => {
+    const bb = Busboy({
+      headers: req.headers as Record<string, string>,
+      limits: {
+        fileSize: MAX_FILE_SIZE_BYTES + 1, // +1 so we can detect over-limit
+        files: 1,
+      },
+    });
+
+    let resolved = false;
+
+    bb.on(
+      'file',
+      (
+        fieldname: string,
+        stream: Readable,
+        info: { filename: string; encoding: string; mimeType: string },
+      ) => {
+        const chunks: Buffer[] = [];
+        let tooLarge = false;
+
+        stream.on('data', (chunk: Buffer) => {
+          chunks.push(chunk);
+        });
+
+        stream.on('limit', () => {
+          tooLarge = true;
+          stream.resume(); // drain so busboy doesn't hang
+        });
+
+        stream.on('end', () => {
+          if (tooLarge) {
+            resolved = true;
+            reject(new Error('FILE_TOO_LARGE'));
+            return;
+          }
+          resolved = true;
+          resolve({
+            fieldname,
+            filename: info.filename,
+            mimeType: info.mimeType,
+            data: Buffer.concat(chunks),
+          });
+        });
+
+        stream.on('error', reject);
+      },
+    );
+
+    bb.on('finish', () => {
+      if (!resolved) {
+        reject(new Error('NO_FILE'));
+      }
+    });
+
+    bb.on('error', reject);
+
+    req.pipe(bb);
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Handler
+// ---------------------------------------------------------------------------
+
+type ResponseData = ValidationResult | { error: string; valid: false };
+
+export default async function handler(
+  req: NextApiRequest,
+  res: NextApiResponse<ResponseData>,
+): Promise<void> {
+  if (req.method !== 'POST') {
+    res.setHeader('Allow', 'POST');
+    res.status(405).end('Method Not Allowed');
+    return;
+  }
+
+  let parsed: ParsedFile;
+
+  try {
+    parsed = await parseFirstFile(req);
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : '';
+
+    if (msg === 'FILE_TOO_LARGE') {
+      res.status(413).json({
+        valid: false,
+        error: `File exceeds the ${MAX_FILE_SIZE_BYTES / (1024 * 1024)} MB size limit.`,
+      });
+      return;
+    }
+
+    if (msg === 'NO_FILE') {
+      res.status(400).json({ valid: false, error: 'No file was uploaded.' });
+      return;
+    }
+
+    // busboy not installed or another parse error
+    const notFound =
+      msg.includes('Cannot find module') || msg.includes('MODULE_NOT_FOUND');
+    if (notFound) {
+      res.status(501).json({
+        valid: false,
+        error:
+          'Server multipart parser not available. ' +
+          'Install busboy: npm install busboy@1.6.0',
+      });
+      return;
+    }
+
+    res.status(400).json({ valid: false, error: 'Failed to parse the uploaded file.' });
+    return;
+  }
+
+  const magicBytes = new Uint8Array(parsed.data.slice(0, 8));
+
+  const result = await validateAttachmentServer(
+    {
+      declaredMimeType: parsed.mimeType,
+      magicBytes,
+      sizeBytes: parsed.data.length,
+      originalFilename: parsed.filename,
+    },
+    // -----------------------------------------------------------------------
+    // Malware-scan hook – STUB.
+    //
+    // Returns null (clean) unconditionally.
+    // In production replace with a real scanner, e.g.:
+    //   import { scanWithClamAV } from '@/lib/clamav';
+    //   return scanWithClamAV(fileBuffer);
+    // -----------------------------------------------------------------------
+    async (_params) => {
+      return null; // null = clean
+    },
+  );
+
+  const status = result.valid ? 200 : 400;
+  res.status(status).json(result);
+}
diff --git a/src/utils/attachmentValidation.test.ts b/src/utils/attachmentValidation.test.ts
new file mode 100644
index 000000000..ee42713f3
--- /dev/null
+++ b/src/utils/attachmentValidation.test.ts
@@ -0,0 +1,345 @@
+/**
+ * attachmentValidation.test.ts
+ *
+ * Unit tests for all exported functions in attachmentValidation.ts.
+ * Covers success, failure, and boundary cases for each rule.
+ */
+import type {
+  ServerAttachmentParams} from './attachmentValidation';
+import {
+  isAllowedMimeType,
+  isWithinSizeLimit,
+  sanitizeFilename,
+  validateAttachment,
+  validateAttachmentServer,
+  hasPdfMagicBytes,
+  MAX_FILE_SIZE_BYTES,
+  MAX_FILENAME_LENGTH
+} from './attachmentValidation';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function makeFile(name: string, size: number, type: string): File {
+  const content = new Uint8Array(size);
+  return new File([content], name, { type });
+}
+
+/** Valid PDF magic bytes: %PDF- */
+const PDF_MAGIC = new Uint8Array([0x25, 0x50, 0x44, 0x46, 0x2d, 0x31, 0x2e, 0x34]);
+const NOT_PDF_MAGIC = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]); // PNG
+
+function makeServerParams(overrides: Partial<ServerAttachmentParams> = {}): ServerAttachmentParams {
+  return {
+    declaredMimeType: 'application/pdf',
+    magicBytes: PDF_MAGIC,
+    sizeBytes: 1024,
+    originalFilename: 'report.pdf',
+    ...overrides,
+  };
+}
+
+// ===========================================================================
+// isAllowedMimeType
+// ===========================================================================
+describe('isAllowedMimeType', () => {
+  it('accepts application/pdf', () => {
+    expect(isAllowedMimeType('application/pdf')).toBe(true);
+  });
+
+  it('rejects image/png', () => {
+    expect(isAllowedMimeType('image/png')).toBe(false);
+  });
+
+  it('rejects image/jpeg', () => {
+    expect(isAllowedMimeType('image/jpeg')).toBe(false);
+  });
+
+  it('rejects application/octet-stream', () => {
+    expect(isAllowedMimeType('application/octet-stream')).toBe(false);
+  });
+
+  it('rejects empty string', () => {
+    expect(isAllowedMimeType('')).toBe(false);
+  });
+
+  it('is case-sensitive (APPLICATION/PDF is rejected)', () => {
+    expect(isAllowedMimeType('APPLICATION/PDF')).toBe(false);
+  });
+});
+
+// ===========================================================================
+// isWithinSizeLimit
+// ===========================================================================
+describe('isWithinSizeLimit', () => {
+  it('accepts 0 bytes', () => {
+    expect(isWithinSizeLimit(0)).toBe(true);
+  });
+
+  it('accepts 1 MB', () => {
+    expect(isWithinSizeLimit(1 * 1024 * 1024)).toBe(true);
+  });
+
+  it('accepts exactly the limit (10 MB)', () => {
+    expect(isWithinSizeLimit(MAX_FILE_SIZE_BYTES)).toBe(true);
+  });
+
+  it('rejects one byte over the limit', () => {
+    expect(isWithinSizeLimit(MAX_FILE_SIZE_BYTES + 1)).toBe(false);
+  });
+
+  it('rejects 11 MB', () => {
+    expect(isWithinSizeLimit(11 * 1024 * 1024)).toBe(false);
+  });
+});
+
+// ===========================================================================
+// sanitizeFilename
+// ===========================================================================
+describe('sanitizeFilename', () => {
+  it('returns a clean filename unchanged', () => {
+    expect(sanitizeFilename('lab-report-2024.pdf')).toBe('lab-report-2024.pdf');
+  });
+
+  it('strips leading and trailing whitespace', () => {
+    expect(sanitizeFilename('  report.pdf  ')).toBe('report.pdf');
+  });
+
+  it('rejects forward-slash path traversal', () => {
+    expect(sanitizeFilename('../../../etc/passwd')).toBeNull();
+  });
+
+  it('rejects backslash path traversal', () => {
+    expect(sanitizeFilename('..\\..\\Windows\\system32')).toBeNull();
+  });
+
+  it('rejects null byte in filename', () => {
+    expect(sanitizeFilename('report\x00.pdf')).toBeNull();
+  });
+
+  it('rejects a filename with a <script> tag', () => {
+    expect(sanitizeFilename('<script>alert(1)</script>.pdf')).toBeNull();
+  });
+
+  it('rejects a filename containing a double-quote', () => {
+    expect(sanitizeFilename('re"port.pdf')).toBeNull();
+  });
+
+  it('rejects a filename containing a single-quote', () => {
+    expect(sanitizeFilename("re'port.pdf")).toBeNull();
+  });
+
+  it('rejects a filename containing an ampersand', () => {
+    expect(sanitizeFilename('re&port.pdf')).toBeNull();
+  });
+
+  it('rejects a filename exceeding MAX_FILENAME_LENGTH', () => {
+    const longName = 'a'.repeat(MAX_FILENAME_LENGTH + 1) + '.pdf';
+    expect(sanitizeFilename(longName)).toBeNull();
+  });
+
+  it('accepts a filename of exactly MAX_FILENAME_LENGTH characters', () => {
+    const exactName = 'a'.repeat(MAX_FILENAME_LENGTH - 4) + '.pdf';
+    // exactly MAX_FILENAME_LENGTH chars
+    expect(exactName.length).toBeLessThanOrEqual(MAX_FILENAME_LENGTH);
+    expect(sanitizeFilename(exactName)).not.toBeNull();
+  });
+
+  it('rejects an empty string', () => {
+    expect(sanitizeFilename('')).toBeNull();
+  });
+
+  it('rejects a string that becomes empty after stripping control chars', () => {
+    expect(sanitizeFilename('\x01\x02\x03')).toBeNull();
+  });
+
+  it('strips control characters but keeps valid content', () => {
+    const result = sanitizeFilename('re\x01port.pdf');
+    expect(result).toBe('report.pdf');
+  });
+
+  it('accepts unicode letters in filenames', () => {
+    expect(sanitizeFilename('résumé-rapport.pdf')).not.toBeNull();
+  });
+});
+
+// ===========================================================================
+// hasPdfMagicBytes
+// ===========================================================================
+describe('hasPdfMagicBytes', () => {
+  it('returns true for valid PDF magic bytes', () => {
+    expect(hasPdfMagicBytes(PDF_MAGIC)).toBe(true);
+  });
+
+  it('returns false for PNG magic bytes', () => {
+    expect(hasPdfMagicBytes(NOT_PDF_MAGIC)).toBe(false);
+  });
+
+  it('returns false for an empty buffer', () => {
+    expect(hasPdfMagicBytes(new Uint8Array([]))).toBe(false);
+  });
+
+  it('returns false for a buffer shorter than the magic sequence', () => {
+    expect(hasPdfMagicBytes(new Uint8Array([0x25, 0x50]))).toBe(false);
+  });
+
+  it('returns false when first byte differs', () => {
+    const bad = new Uint8Array(PDF_MAGIC);
+    bad[0] = 0x00;
+    expect(hasPdfMagicBytes(bad)).toBe(false);
+  });
+});
+
+// ===========================================================================
+// validateAttachment (client-side composite)
+// ===========================================================================
+describe('validateAttachment', () => {
+  it('returns valid for a good PDF under the size limit', () => {
+    const file = makeFile('report.pdf', 1024, 'application/pdf');
+    expect(validateAttachment(file)).toEqual({ valid: true });
+  });
+
+  it('returns invalid for an image/png file', () => {
+    const file = makeFile('photo.png', 1024, 'image/png');
+    const result = validateAttachment(file);
+    expect(result.valid).toBe(false);
+    expect(result.error).toMatch(/pdf/i);
+  });
+
+  it('returns invalid for an oversized PDF', () => {
+    const file = makeFile('big.pdf', MAX_FILE_SIZE_BYTES + 1, 'application/pdf');
+    const result = validateAttachment(file);
+    expect(result.valid).toBe(false);
+    expect(result.error).toMatch(/10\s*mb|too large|size/i);
+  });
+
+  it('returns valid for a PDF that is exactly the size limit', () => {
+    const file = makeFile('exact.pdf', MAX_FILE_SIZE_BYTES, 'application/pdf');
+    expect(validateAttachment(file)).toEqual({ valid: true });
+  });
+
+  it('returns invalid for a path-traversal filename', () => {
+    const file = makeFile('../../../etc/passwd', 1024, 'application/pdf');
+    const result = validateAttachment(file);
+    expect(result.valid).toBe(false);
+    expect(result.error).toMatch(/filename|invalid/i);
+  });
+
+  it('returns invalid for an excessively long filename', () => {
+    const file = makeFile('a'.repeat(256) + '.pdf', 1024, 'application/pdf');
+    const result = validateAttachment(file);
+    expect(result.valid).toBe(false);
+  });
+
+  it('returns invalid for a filename with HTML injection', () => {
+    const file = makeFile('<script>x</script>.pdf', 1024, 'application/pdf');
+    const result = validateAttachment(file);
+    expect(result.valid).toBe(false);
+  });
+
+  it('returns invalid for an empty MIME type', () => {
+    const file = makeFile('report.pdf', 1024, '');
+    const result = validateAttachment(file);
+    expect(result.valid).toBe(false);
+  });
+
+  it('MIME check fires before size check', () => {
+    // Wrong type AND oversized – error should mention type, not size
+    const file = makeFile('photo.png', MAX_FILE_SIZE_BYTES + 1, 'image/png');
+    const result = validateAttachment(file);
+    expect(result.valid).toBe(false);
+    expect(result.error).toMatch(/pdf/i);
+  });
+});
+
+// ===========================================================================
+// validateAttachmentServer (server-side composite)
+// ===========================================================================
+describe('validateAttachmentServer', () => {
+  const cleanScan = async () => null;
+  const threatScan = async () => 'Trojan.Generic detected';
+
+  it('returns valid for a well-formed PDF request', async () => {
+    const result = await validateAttachmentServer(makeServerParams(), cleanScan);
+    expect(result).toEqual({ valid: true });
+  });
+
+  it('rejects a disallowed MIME type', async () => {
+    const result = await validateAttachmentServer(
+      makeServerParams({ declaredMimeType: 'image/png' }),
+      cleanScan,
+    );
+    expect(result.valid).toBe(false);
+    expect(result.error).toMatch(/pdf/i);
+  });
+
+  it('rejects when magic bytes do not match PDF', async () => {
+    const result = await validateAttachmentServer(
+      makeServerParams({ magicBytes: NOT_PDF_MAGIC }),
+      cleanScan,
+    );
+    expect(result.valid).toBe(false);
+    expect(result.error).toMatch(/content|type|pdf/i);
+  });
+
+  it('rejects an oversized file', async () => {
+    const result = await validateAttachmentServer(
+      makeServerParams({ sizeBytes: MAX_FILE_SIZE_BYTES + 1 }),
+      cleanScan,
+    );
+    expect(result.valid).toBe(false);
+    expect(result.error).toMatch(/10\s*mb|size/i);
+  });
+
+  it('accepts a file of exactly the size limit', async () => {
+    const result = await validateAttachmentServer(
+      makeServerParams({ sizeBytes: MAX_FILE_SIZE_BYTES }),
+      cleanScan,
+    );
+    expect(result).toEqual({ valid: true });
+  });
+
+  it('rejects a path-traversal filename', async () => {
+    const result = await validateAttachmentServer(
+      makeServerParams({ originalFilename: '../../../etc/passwd' }),
+      cleanScan,
+    );
+    expect(result.valid).toBe(false);
+    expect(result.error).toMatch(/filename/i);
+  });
+
+  it('rejects when the malware scan returns a threat', async () => {
+    const result = await validateAttachmentServer(makeServerParams(), threatScan);
+    expect(result.valid).toBe(false);
+    expect(result.error).toMatch(/Trojan/i);
+  });
+
+  it('uses the no-op scanner by default (no scan argument)', async () => {
+    const result = await validateAttachmentServer(makeServerParams());
+    expect(result).toEqual({ valid: true });
+  });
+
+  it('MIME check fires before magic-byte check', async () => {
+    // Wrong MIME AND wrong magic – error should mention type
+    const result = await validateAttachmentServer(
+      makeServerParams({ declaredMimeType: 'image/png', magicBytes: NOT_PDF_MAGIC }),
+      cleanScan,
+    );
+    expect(result.valid).toBe(false);
+    expect(result.error).toMatch(/pdf/i);
+  });
+
+  it('magic-byte check fires before size check', async () => {
+    // Wrong magic AND oversized – error should mention content/type
+    const result = await validateAttachmentServer(
+      makeServerParams({
+        magicBytes: NOT_PDF_MAGIC,
+        sizeBytes: MAX_FILE_SIZE_BYTES + 1,
+      }),
+      cleanScan,
+    );
+    expect(result.valid).toBe(false);
+    expect(result.error).toMatch(/content|type|pdf/i);
+  });
+});
diff --git a/src/utils/attachmentValidation.ts b/src/utils/attachmentValidation.ts
new file mode 100644
index 000000000..66c8c5d71
--- /dev/null
+++ b/src/utils/attachmentValidation.ts
@@ -0,0 +1,246 @@
+/**
+ * attachmentValidation.ts
+ *
+ * Shared validation logic for medical lab-report attachments.
+ * Runs on the client (UploadModal) and on the server (Next.js API route).
+ *
+ * Security assumptions documented here:
+ *  - MIME-type allowlist is the primary type gate.  Browser-supplied MIME
+ *    types are untrusted, so the server MUST re-check the magic bytes.
+ *  - The 10 MB limit protects both the upload budget and downstream storage.
+ *  - Filename sanitization prevents path traversal and stored-XSS vectors.
+ *  - The malware-scan hook is a stub that callers replace in production
+ *    (e.g. ClamAV, AWS Malware Protection for S3).
+ */
+
+// ---------------------------------------------------------------------------
+// Configuration
+// ---------------------------------------------------------------------------
+
+/** MIME types accepted for medical attachments. */
+export const ALLOWED_MIME_TYPES: ReadonlySet<string> = new Set([
+  'application/pdf',
+]);
+
+/** Human-readable label shown in error messages. */
+export const ALLOWED_EXTENSIONS_LABEL = 'PDF';
+
+/** Maximum allowed file size in bytes (10 MB). */
+export const MAX_FILE_SIZE_BYTES = 10 * 1024 * 1024; // 10 MB
+
+/** Maximum filename length (characters, excluding the extension). */
+export const MAX_FILENAME_LENGTH = 200;
+
+// ---------------------------------------------------------------------------
+// Result type
+// ---------------------------------------------------------------------------
+
+export interface ValidationResult {
+  /** true when the file passes every check. */
+  valid: boolean;
+  /** Human-readable rejection reason, or undefined when valid. */
+  error?: string;
+}
+
+// ---------------------------------------------------------------------------
+// Individual validators
+// ---------------------------------------------------------------------------
+
+/**
+ * Returns true when the MIME type is in the explicit allowlist.
+ * NOTE: On the server you must also verify the file magic bytes.
+ */
+export function isAllowedMimeType(mimeType: string): boolean {
+  return ALLOWED_MIME_TYPES.has(mimeType);
+}
+
+/** Returns true when the file size is within the configured limit. */
+export function isWithinSizeLimit(sizeBytes: number): boolean {
+  return sizeBytes <= MAX_FILE_SIZE_BYTES;
+}
+
+/**
+ * Returns a sanitized filename string, or null if the name is
+ * fundamentally unsafe and must be rejected.
+ *
+ * Rules enforced:
+ *  1. Path separators and null bytes – reject (path-traversal).
+ *  2. HTML special characters (<, >, ", ', &) – reject (stored-XSS).
+ *  3. Length > MAX_FILENAME_LENGTH – reject.
+ *  4. Leading/trailing whitespace – stripped.
+ *  5. Control characters – stripped.
+ *
+ * The function returns the sanitized name so callers can display it;
+ * a null return means the file must be rejected entirely.
+ */
+export function sanitizeFilename(filename: string): string | null {
+  // Reject immediately if a null byte is present (before any stripping)
+  if (filename.includes('\0')) {
+    return null;
+  }
+
+  // Strip leading/trailing whitespace
+  let name = filename.trim();
+
+  // Remove ASCII control characters (0x01–0x1F, 0x7F) — null already guarded above
+  name = name.replace(/[\x01-\x1F\x7F]/g, '');
+
+  // Reject path-traversal sequences
+  if (/[/\\]/.test(name) || name.includes('..')) {
+    return null;
+  }
+
+  // Reject HTML injection characters
+  if (/[<>"'&]/.test(name)) {
+    return null;
+  }
+
+  // Reject if still empty after stripping
+  if (name.length === 0) {
+    return null;
+  }
+
+  // Reject excessively long filenames
+  if (name.length > MAX_FILENAME_LENGTH) {
+    return null;
+  }
+
+  return name;
+}
+
+// ---------------------------------------------------------------------------
+// Composite client-side validator
+// ---------------------------------------------------------------------------
+
+/**
+ * Validates a File object on the client side.
+ *
+ * Checks, in order:
+ *  1. MIME-type allowlist
+ *  2. File size limit
+ *  3. Filename safety
+ */
+export function validateAttachment(file: File): ValidationResult {
+  if (!isAllowedMimeType(file.type)) {
+    return {
+      valid: false,
+      error: `Only ${ALLOWED_EXTENSIONS_LABEL} files are accepted. The selected file type (${file.type || 'unknown'}) is not allowed.`,
+    };
+  }
+
+  if (!isWithinSizeLimit(file.size)) {
+    const limitMB = MAX_FILE_SIZE_BYTES / (1024 * 1024);
+    const fileMB = (file.size / (1024 * 1024)).toFixed(1);
+    return {
+      valid: false,
+      error: `File is too large (${fileMB} MB). The maximum allowed size is ${limitMB} MB.`,
+    };
+  }
+
+  const sanitized = sanitizeFilename(file.name);
+  if (sanitized === null) {
+    return {
+      valid: false,
+      error: `Invalid filename "${file.name}". Filenames must not contain path separators, HTML characters, or be longer than ${MAX_FILENAME_LENGTH} characters.`,
+    };
+  }
+
+  return { valid: true };
+}
+
+// ---------------------------------------------------------------------------
+// Server-side validator (Node.js / Next.js API routes)
+// ---------------------------------------------------------------------------
+
+/**
+ * Parameters for the server-side validation hook.
+ * Matches the shape of data available in a Next.js API route after parsing
+ * a multipart/form-data body with a library such as formidable or busboy.
+ */
+export interface ServerAttachmentParams {
+  /** The MIME type declared by the client – untrusted, re-check with magic bytes. */
+  declaredMimeType: string;
+  /** First 8 bytes of the file content for magic-byte verification. */
+  magicBytes: Uint8Array;
+  /** File size in bytes. */
+  sizeBytes: number;
+  /** Original filename from the multipart header. */
+  originalFilename: string;
+}
+
+/**
+ * PDF magic bytes: every valid PDF starts with "%PDF-" (25 50 44 46 2D).
+ */
+const PDF_MAGIC = new Uint8Array([0x25, 0x50, 0x44, 0x46, 0x2d]);
+
+/** Checks whether the first bytes of a buffer match the PDF magic sequence. */
+export function hasPdfMagicBytes(bytes: Uint8Array): boolean {
+  if (bytes.length < PDF_MAGIC.length) return false;
+  for (let i = 0; i < PDF_MAGIC.length; i++) {
+    if (bytes[i] !== PDF_MAGIC[i]) return false;
+  }
+  return true;
+}
+
+/**
+ * Server-side composite validator.
+ *
+ * Adds magic-byte verification on top of the client checks so that a file
+ * whose MIME type was spoofed by the client is caught before storage.
+ *
+ * Malware scanning is delegated to the `scanForMalware` hook.  In
+ * production supply a real implementation; the default no-op is safe for
+ * development only.
+ */
+export async function validateAttachmentServer(
+  params: ServerAttachmentParams,
+  /**
+   * Malware-scan hook.  Returns a rejection reason string if the scan
+   * detects a threat, or null/undefined if the file is clean.
+   *
+   * Replace with a real ClamAV / cloud scanning integration in production.
+   */
+  scanForMalware: (params: ServerAttachmentParams) => Promise<string | null> = async () => null,
+): Promise<ValidationResult> {
+  // 1. MIME type allowlist (declared)
+  if (!isAllowedMimeType(params.declaredMimeType)) {
+    return {
+      valid: false,
+      error: `Only ${ALLOWED_EXTENSIONS_LABEL} files are accepted.`,
+    };
+  }
+
+  // 2. Magic-byte verification (guards against MIME-type spoofing)
+  if (!hasPdfMagicBytes(params.magicBytes)) {
+    return {
+      valid: false,
+      error: 'File content does not match its declared type. Only real PDF files are accepted.',
+    };
+  }
+
+  // 3. File size
+  if (!isWithinSizeLimit(params.sizeBytes)) {
+    const limitMB = MAX_FILE_SIZE_BYTES / (1024 * 1024);
+    return {
+      valid: false,
+      error: `File exceeds the ${limitMB} MB size limit.`,
+    };
+  }
+
+  // 4. Filename safety
+  const sanitized = sanitizeFilename(params.originalFilename);
+  if (sanitized === null) {
+    return {
+      valid: false,
+      error: `Invalid filename. Filenames must not contain path separators, HTML characters, or exceed ${MAX_FILENAME_LENGTH} characters.`,
+    };
+  }
+
+  // 5. Malware scan
+  const threatReason = await scanForMalware(params);
+  if (threatReason) {
+    return { valid: false, error: `File rejected: ${threatReason}` };
+  }
+
+  return { valid: true };
+}