SA-010 Avatar validation

backend/tests/test_user_config.py

@@ -1,7 +1,10 @@
 ## Copyright © 2026 Olaf Kolkman
 ## SPDX-License-Identifier: GPL-3.0-or-later
 
+from io import BytesIO
+
 from fastapi.testclient import TestClient
+from PIL import Image
 from unittest.mock import patch
 
 from backend.app.main import app
@@ -68,15 +71,29 @@ def test_user_config_api_and_profile_page():
         'new_password': 'secret123',
     }, headers=bob_headers).status_code == 200
 
+    image_buffer = BytesIO()
+    Image.new('RGB', (2, 2), 'red').save(image_buffer, format='JPEG')
     upload_response = client.post(
         '/api/user/avatar',
         headers=headers,
-        files={'avatar': ('avatar.png', b'fake-png-data', 'image/png')},
+        files={'avatar': ('avatar.jpg', image_buffer.getvalue(), 'image/jpeg')},
     )
     assert upload_response.status_code == 200
     avatar_url = upload_response.json()['avatar_url']
     assert avatar_url.startswith('/media/user-1.png')
-    assert client.get(avatar_url).content == b'fake-png-data'
+    stored_avatar = client.get(avatar_url)
+    assert stored_avatar.status_code == 200
+    assert stored_avatar.headers['content-type'] == 'image/png'
+    with Image.open(BytesIO(stored_avatar.content)) as image:
+        assert image.format == 'PNG'
+        assert image.size == (2, 2)
+
+    rejected_upload = client.post(
+        '/api/user/avatar',
+        headers=headers,
+        files={'avatar': ('avatar.png', b'fake-png-data', 'image/png')},
+    )
+    assert rejected_upload.status_code == 415
 
     updated_profile = client.get('/api/user/me', headers=headers).json()
     assert updated_profile['avatar_url'] == avatar_url