fix: harden week-two ordering, artwork and operations

app/core/limits.py

@@ -0,0 +1,13 @@
+"""Limits shared by upload admission and the malware scanner."""
+import os
+
+CLAMAV_STREAM_MAX_BYTES = 128 * 1024 * 1024  # infra/clamd.conf
+
+
+def scan_limit_bytes():
+    return min(CLAMAV_STREAM_MAX_BYTES, int(os.environ.get('SCAN_MAX_BYTES', '134217728')))
+
+
+def upload_limit_bytes():
+    transport = int(os.environ.get('MAX_UPLOAD_BYTES', '5368709120'))
+    return min(transport, scan_limit_bytes())

app/core/models.py

@@ -2,7 +2,7 @@ import re
 from decimal import Decimal
 from typing import Literal
 from uuid import UUID
-from pydantic import BaseModel, ConfigDict, Field, field_validator
+from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
 
 class StrictModel(BaseModel):
     model_config = ConfigDict(extra='forbid', allow_inf_nan=False)
@@ -56,11 +56,80 @@ class UploadStart(StrictModel):
             raise ValueError('Unsupported artwork file extension')
         return value
 
+class ProductionSource(StrictModel):
+    upload_id: UUID
+    kind: Literal['sheet', 'artwork']
+    width_cm: Decimal = Field(gt=0, le=57)
+    length_cm: Decimal = Field(gt=0, le=6000)
+    copies: int = Field(ge=1, le=200, strict=True)
+    rotation_degrees: Literal[0, 90] = 0
+    mirrored: bool = False
+    measurement: Literal['file', 'customer']
+
+class ProductionPlacement(StrictModel):
+    source_index: int = Field(ge=0, le=19, strict=True)
+    copy_index: int = Field(ge=0, le=199, strict=True)
+    x_cm: Decimal = Field(ge=0, le=57)
+    y_cm: Decimal = Field(ge=0, le=1200000)
+    width_cm: Decimal = Field(gt=0, le=57)
+    length_cm: Decimal = Field(gt=0, le=6000)
+    rotation_degrees: Literal[0, 90, 180, 270]
+    mirrored: bool
+
+class ProductionSpec(StrictModel):
+    version: Literal[2]
+    film_width_cm: Decimal
+    height_cm: Decimal = Field(gt=0, le=1200000)
+    sources: list[ProductionSource] = Field(min_length=1, max_length=20)
+    placements: list[ProductionPlacement] = Field(min_length=1, max_length=4000)
+
 class Item(StrictModel):
     mode: Literal['file','avulsa','uvfile','uv']
     metres: Decimal = Field(gt=0, le=12000)
     grade: int = Field(ge=0, le=100, strict=True)
     uploads: list[UUID] = Field(min_length=1, max_length=20)
+    production: ProductionSpec
+    quality_status: Literal['ok', 'warning', 'unverified']
+    quality_acknowledged: bool
+
+    @model_validator(mode='after')
+    def production_matches_uploads(self):
+        if [source.upload_id for source in self.production.sources] != self.uploads:
+            raise ValueError('Production sources must match uploaded files in order')
+        is_sheet = self.mode in ('file', 'uvfile')
+        film_width = Decimal('28.5') if self.mode in ('uvfile', 'uv') else Decimal('57')
+        if self.production.film_width_cm != film_width:
+            raise ValueError('Production film width does not match the product')
+        for source in self.production.sources:
+            if (source.kind == 'sheet') != is_sheet or source.width_cm > film_width:
+                raise ValueError('Production source does not fit the selected product')
+            if is_sheet and (source.rotation_degrees or source.mirrored):
+                raise ValueError('Finished sheets cannot be rotated or mirrored by the layout')
+        expected={(index,copy) for index,source in enumerate(self.production.sources)
+                  for copy in range(source.copies)}
+        placed=set()
+        tolerance=Decimal('0.02')
+        for placement in self.production.placements:
+            key=(placement.source_index,placement.copy_index)
+            if key not in expected or key in placed:
+                raise ValueError('Production placement has a missing or duplicate source copy')
+            placed.add(key)
+            source=self.production.sources[placement.source_index]
+            auto_rotation=(placement.rotation_degrees-source.rotation_degrees)%360
+            if auto_rotation not in (0,90) or placement.mirrored != source.mirrored:
+                raise ValueError('Production placement changes the source transform')
+            width,length=(source.width_cm,source.length_cm) if auto_rotation==0 else (source.length_cm,source.width_cm)
+            if abs(placement.width_cm-width)>tolerance or abs(placement.length_cm-length)>tolerance:
+                raise ValueError('Production placement changes the source size')
+            if placement.x_cm+placement.width_cm>film_width+tolerance or placement.y_cm+placement.length_cm>self.production.height_cm+tolerance:
+                raise ValueError('Production placement is outside the film')
+            if is_sheet and (placement.x_cm or auto_rotation):
+                raise ValueError('Finished sheets must retain their original orientation')
+        if placed != expected:
+            raise ValueError('Production layout does not cover every source copy')
+        if self.quality_status == 'warning' and not self.quality_acknowledged:
+            raise ValueError('Resolution warning must be acknowledged')
+        return self
 
 class QuoteRequest(StrictModel):
     request_key: UUID