🔒️(backend) prevnt file change post checks

Before this commit, post a file check, the policy could be
reused to change the verified file.
Now, files are uplaoded to a temporary location, then inside
a transaction that prevents concurrent calls, the file is
copied to its final destination and the checks are run on that one.
A new file can still be updated with the policy but it will never be read, etc.

As part of this change, all files in the new tmp directory
on s3 should have an expiration policy.

src/backend/core/tests/files/test_api_files_create.py

@@ -118,7 +118,7 @@ def test_api_files_create_file_authenticated_success():
 
     assert policy_parsed.scheme == "http"
     assert policy_parsed.netloc in ["minio:9000", "localhost:9000"]
-    assert policy_parsed.path == f"/meet-media-storage/files/{file.id!s}.png"
+    assert policy_parsed.path == f"/meet-media-storage/tmp/files/{file.id!s}.png"
 
     query_params = parse_qs(policy_parsed.query)
 

src/backend/core/tests/files/test_api_files_upload_ended.py

@@ -1,6 +1,7 @@
 """Test related to item upload ended API."""
 
 import logging
+from concurrent.futures import ThreadPoolExecutor
 from io import BytesIO
 
 from django.core.files.storage import default_storage
@@ -81,7 +82,7 @@ def test_api_file_upload_ended_success(settings):
     )
 
     default_storage.save(
-        file.file_key,
+        file.temporary_file_key,
         BytesIO(b"my prose"),
     )
 
@@ -97,6 +98,7 @@ def test_api_file_upload_ended_success(settings):
     assert response.json()["mimetype"] == "text/plain"
 
 
+@pytest.mark.django_db(transaction=True)
 def test_api_file_upload_ended_mimetype_not_allowed(settings, caplog):
     """
     Test that the API returns a 400 when the mimetype is not allowed.
@@ -119,7 +121,7 @@ def test_api_file_upload_ended_mimetype_not_allowed(settings, caplog):
     )
 
     default_storage.save(
-        file.file_key,
+        file.temporary_file_key,
         BytesIO(b"my prose"),
     )
 
@@ -156,7 +158,7 @@ def test_api_file_upload_ended_mimetype_not_allowed_not_checking_mimetype(settin
     )
 
     default_storage.save(
-        file.file_key,
+        file.temporary_file_key,
         BytesIO(b"my prose"),
     )
 
@@ -200,7 +202,7 @@ def test_api_upload_ended_mismatch_mimetype_with_object_storage(settings, caplog
 
     s3_client.put_object(
         Bucket=default_storage.bucket_name,
-        Key=file.file_key,
+        Key=file.temporary_file_key,
         ContentType="text/html",
         Body=BytesIO(
             b'<meta http-equiv="refresh" content="0; url=https://fichiers.numerique.gouv.fr">'
@@ -211,7 +213,7 @@ def test_api_upload_ended_mismatch_mimetype_with_object_storage(settings, caplog
     )
 
     head_object = s3_client.head_object(
-        Bucket=default_storage.bucket_name, Key=file.file_key
+        Bucket=default_storage.bucket_name, Key=file.temporary_file_key
     )
 
     assert head_object["ContentType"] == "text/html"
@@ -234,9 +236,10 @@ def test_api_upload_ended_mismatch_mimetype_with_object_storage(settings, caplog
     assert head_object["Metadata"] == {"foo": "bar"}
 
 
+@pytest.mark.django_db(transaction=True)
 def test_api_upload_ended_file_size_exceeded(settings, caplog):
     """
-    Test when the file size exceed the allowed max upload file size
+    Test when the file size exceeds the allowed max upload file size
     should return a 400 and delete the file.
     """
 
@@ -256,7 +259,7 @@ def test_api_upload_ended_file_size_exceeded(settings, caplog):
     )
 
     default_storage.save(
-        file.file_key,
+        file.temporary_file_key,
         BytesIO(b"my prose"),
     )
 
@@ -270,3 +273,48 @@ def test_api_upload_ended_file_size_exceeded(settings, caplog):
 
     assert not models.File.objects.filter(id=file.id).exists()
     assert not default_storage.exists(file.file_key)
+
+
+@pytest.mark.django_db(transaction=True)
+def test_api_file_upload_ended_concurrent_calls_are_serialized(settings):
+    """Only one concurrent upload-ended call can finalize a pending upload."""
+    settings.FILE_UPLOAD_APPLY_RESTRICTIONS = True
+    settings.FILE_UPLOAD_RESTRICTIONS = {
+        "background_image": {
+            **settings.FILE_UPLOAD_RESTRICTIONS["background_image"],
+            "allowed_mimetypes": ["text/plain"],
+        },
+    }
+
+    user = factories.UserFactory()
+    file = factories.FileFactory(
+        type=FileTypeChoices.BACKGROUND_IMAGE,
+        filename="my_file.txt",
+        creator=user,
+    )
+    default_storage.save(file.temporary_file_key, BytesIO(b"my prose"))
+
+    def call_upload_ended():
+        client = APIClient()
+        client.force_login(user)
+        return client.post(f"/api/v1.0/files/{file.id!s}/upload-ended/")
+
+    with ThreadPoolExecutor(max_workers=2) as executor:
+        futures = [
+            executor.submit(call_upload_ended),
+            executor.submit(call_upload_ended),
+        ]
+        responses = [future.result() for future in futures]
+
+    status_codes = sorted(response.status_code for response in responses)
+    assert status_codes == [200, 400]
+
+    failed_response = next(
+        response for response in responses if response.status_code == 400
+    )
+    assert failed_response.json() == {
+        "file": "This action is only available for files in PENDING state."
+    }
+
+    file.refresh_from_db()
+    assert file.upload_state == FileUploadStateChoices.READY