fix(upload): store sniffed MIME instead of generic CDN content-type

backend/routes/upload.js

@@ -286,7 +286,14 @@ function downloadImage(imageUrl, maxRedirects = 5) {
     const parsed = new URL(imageUrl);
     const client = parsed.protocol === 'https:' ? https : http;
 
-    client.get(imageUrl, { timeout: 30000 }, (response) => {
+    // Browser-like headers: many CDNs (film.ai, frameset, etc.) reject
+    // requests without UA/Referer with 403.
+    const requestHeaders = {
+      "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36",
+      "Accept": "image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8",
+      "Referer": parsed.origin + "/",
+    };
+    client.get(imageUrl, { timeout: 30000, headers: requestHeaders }, (response) => {
       // Follow redirects up to maxRedirects times
       if ([301, 302, 303, 307, 308].includes(response.statusCode) && response.headers.location) {
         if (maxRedirects <= 0) {
@@ -300,9 +307,11 @@ function downloadImage(imageUrl, maxRedirects = 5) {
       }
 
       const contentType = (response.headers['content-type'] || '').split(';')[0].trim();
-      if (!ALLOWED_MIME_TYPES.includes(contentType)) {
+      const GENERIC_TYPES = ['binary/octet-stream', 'application/octet-stream'];
+      if (!ALLOWED_MIME_TYPES.includes(contentType) && !GENERIC_TYPES.includes(contentType)) {
         return reject(new Error(`Unsupported content type: ${contentType}`));
       }
+      const typeIsGeneric = GENERIC_TYPES.includes(contentType);
 
       const chunks = [];
       let totalSize = 0;
@@ -318,8 +327,17 @@ function downloadImage(imageUrl, maxRedirects = 5) {
 
       response.on('end', () => {
         const buffer = Buffer.concat(chunks);
+        let resolvedType = contentType;
+        if (typeIsGeneric) {
+          // Replace the generic CDN type with what the bytes actually are,
+          // so the correct MIME gets stored and served.
+          resolvedType = sniffMimeExact(buffer);
+          if (!resolvedType) {
+            return reject(new Error('Unsupported content type: binary/octet-stream (unknown magic bytes)'));
+          }
+        }
         const filename = parsed.pathname.split('/').pop() || 'image';
-        resolve({ buffer, mimeType: contentType, filename });
+        resolve({ buffer, mimeType: resolvedType, filename });
       });
 
       response.on('error', reject);
@@ -418,4 +436,24 @@ router.use((err, req, res, next) => {
   next(err);
 });
 
+
+// Sniff the real MIME type from magic bytes (for CDNs that serve everything
+// as binary/octet-stream). Returns the exact MIME or null.
+function sniffMimeExact(buf) {
+  if (!buf || buf.length < 12) return null;
+  const hex = buf.slice(0, 12).toString('hex');
+  const ascii = buf.slice(0, 12).toString('latin1');
+  if (hex.startsWith('89504e47')) return 'image/png';
+  if (hex.startsWith('ffd8ff')) return 'image/jpeg';
+  if (ascii.startsWith('GIF87a') || ascii.startsWith('GIF89a')) return 'image/gif';
+  if (ascii.startsWith('RIFF') && buf.slice(8, 12).toString('latin1') === 'WEBP') return 'image/webp';
+  if (ascii.startsWith('%PDF')) return 'application/pdf';
+  if (buf.slice(4, 8).toString('latin1') === 'ftyp') {
+    const brand = buf.slice(8, 12).toString('latin1');
+    return brand.startsWith('qt') ? 'video/quicktime' : 'video/mp4';
+  }
+  if (hex.startsWith('1a45dfa3')) return 'video/webm';
+  return null;
+}
+
 module.exports = router;