# Spec Delta

## Purpose

Allow users to view durable plant-unit and asset photos while ensuring uploaded files are validated and protected.

## ADDED Requirements

### Requirement: Validated photo mutations
Only ADMIN/SUPERVISOR SHALL upload, replace, or remove photos of active units/assets. Uploads SHALL accept one genuine decodable JPEG, PNG, or WebP up to 2 MiB and 20 million pixels. The server SHALL reject other content, including spoofed MIME types, and SHALL NOT fetch arbitrary client URLs or accept base64 images in metadata requests.

#### Scenario: Spoofed upload
- **WHEN** a non-image file is submitted with an image MIME type
- **THEN** the API rejects it without changing the current photo

### Requirement: Protected durable retrieval
Photos SHALL survive process restarts and be retrievable only by authenticated authorized readers. Responses SHALL expose a controlled photo URL rather than an internal filesystem path. Client-supplied paths SHALL NOT determine stored or retrieved filenames.

#### Scenario: Unauthenticated retrieval
- **WHEN** a request without valid authentication attempts to retrieve a photo
- **THEN** no image bytes are disclosed

### Requirement: Safe replacement and removal
Photo mutations SHALL respect the entity version. Failed or conflicting replacements SHALL preserve the current photo. Successful removal SHALL clear the reference without deleting the asset. Abandoned upload files SHALL be eligible for safe cleanup without removing any referenced photo.

#### Scenario: Database failure after upload
- **WHEN** saving the new photo reference fails
- **THEN** the original photo remains accessible and the abandoned file does not become the entity's photo