fix(security): VULN-009 magic-byte MIME validation + UTC date fix

- uploadEvidenceFile: validate file type via file-type magic bytes, reject
  client-supplied MIME, derive extension from detected type, upload ArrayBuffer
- getEscalationThreshold: use setUTCHours instead of setHours so date-only ISO
  strings (always UTC midnight) compare consistently in any timezone
- Tests: mock file-type, update upload expectation to ArrayBuffer

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

lib/notifications/capa-escalation.ts

@@ -8,9 +8,9 @@ export type EscalationThreshold = 'warning_3d' | 'due_today' | 'overdue_3d' | 'o
 
 export function getEscalationThreshold(dueDateIso: string): EscalationThreshold | null {
   const today = new Date()
-  today.setHours(0, 0, 0, 0)
+  today.setUTCHours(0, 0, 0, 0)
   const due = new Date(dueDateIso)
-  due.setHours(0, 0, 0, 0)
+  // date-only ISO strings are parsed as UTC midnight — keep due in UTC too
   const diffDays = Math.round((due.getTime() - today.getTime()) / 86_400_000)
 
   if (diffDays === 3) return 'warning_3d'

lib/supabase/storage.ts

@@ -1,34 +1,52 @@
 import type { SupabaseClient } from '@supabase/supabase-js'
+import { fileTypeFromBuffer } from 'file-type'
 
 export type EvidenceStage = 'report' | 'response' | 'investigation' | 'capa' | 'verification'
 
+const ALLOWED_MIME_TYPES = new Set([
+  'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/heic', 'image/avif',
+  'video/mp4', 'video/quicktime', 'video/webm', 'video/x-msvideo',
+  'application/pdf',
+  'application/msword',
+  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  'application/vnd.ms-excel',
+  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+])
+
 export async function uploadEvidenceFile(
   supabase: SupabaseClient,
   file: File,
   incidentId: string,
   stage: EvidenceStage,
 ): Promise<{ path: string; publicUrl: string; hash: string }> {
-  // Fix 3: Safe auth.getUser() destructuring
   const { data, error: authError } = await supabase.auth.getUser()
   if (authError || !data?.user) throw new Error('Not authenticated')
   const user = data.user
 
-  // Fix 2: Server-side size limit before processing
+  // Server-side size limit before processing
   const isVideo = file.type.startsWith('video/')
   const maxBytes = isVideo ? 200 * 1024 * 1024 : 10 * 1024 * 1024
   if (file.size > maxBytes) {
     throw new Error(`File too large: max ${isVideo ? '200MB' : '10MB'} for this file type`)
   }
 
-  const ext = file.name.split('.').pop() ?? 'bin'
+  // Magic-byte validation — do not trust client-supplied MIME type
+  const buffer = await file.arrayBuffer()
+  const detected = await fileTypeFromBuffer(buffer)
+  const detectedMime = detected?.mime ?? null
+  if (!detectedMime || !ALLOWED_MIME_TYPES.has(detectedMime)) {
+    throw new Error(`File type not allowed: ${detectedMime ?? 'unknown'}`)
+  }
+
+  const ext = detected?.ext ?? file.name.split('.').pop() ?? 'bin'
   const filename = `${Date.now()}-${Math.random().toString(36).slice(2)}.${ext}`
   const path = `${user.id}/${incidentId}/${stage}/${filename}`
 
-  const hash = await computeHash(file)
+  const hash = await computeHashFromBuffer(buffer)
 
   const { data: uploadData, error } = await supabase.storage
     .from('evidence')
-    .upload(path, file, { contentType: file.type, upsert: false })
+    .upload(path, buffer, { contentType: detectedMime, upsert: false })
 
   if (error) throw new Error(error.message)
 
@@ -48,8 +66,7 @@ export async function getEvidenceUrl(supabase: SupabaseClient, path: string): Pr
   return data.signedUrl
 }
 
-async function computeHash(file: File): Promise<string> {
-  const buffer = await file.arrayBuffer()
+async function computeHashFromBuffer(buffer: ArrayBuffer): Promise<string> {
   const hashBuffer = await crypto.subtle.digest('SHA-256', buffer)
   return Array.from(new Uint8Array(hashBuffer))
     .map(b => b.toString(16).padStart(2, '0'))