feat: improve attachment headers (#13709)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Safer, consistent file downloads with automatic attachment headers and
filenames.
- Smarter MIME detection for uploads (avatars, workspace blobs, Copilot
files/transcripts).
  - Sensible default buffer limit when reading uploads.

- **Bug Fixes**
- Prevents risky content from rendering inline by forcing downloads and
adding no‑sniff protection.
- More accurate content types when original metadata is missing or
incorrect.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/server/src/__tests__/copilot.e2e.ts

@@ -30,6 +30,7 @@ import {
   createTestingApp,
   createWorkspace,
   inviteUser,
+  smallestPng,
   TestingApp,
   TestUser,
 } from './utils';
@@ -453,8 +454,6 @@ test('should create message correctly', async t => {
         randomUUID(),
         textPromptName
       );
-      const smallestPng =
-        'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAgAAAAIAQMAAAD+wSzIAAAABlBMVEX///+/v7+jQ3Y5AAAADklEQVQI12P4AIX8EAgALgAD/aNpbtEAAAAASUVORK5CYII';
       const pngData = await fetch(smallestPng).then(res => res.arrayBuffer());
       const messageId = await createCopilotMessage(
         app,
@@ -475,8 +474,6 @@ test('should create message correctly', async t => {
         randomUUID(),
         textPromptName
       );
-      const smallestPng =
-        'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAgAAAAIAQMAAAD+wSzIAAAABlBMVEX///+/v7+jQ3Y5AAAADklEQVQI12P4AIX8EAgALgAD/aNpbtEAAAAASUVORK5CYII';
       const pngData = await fetch(smallestPng).then(res => res.arrayBuffer());
       const messageId = await createCopilotMessage(
         app,

packages/backend/server/src/__tests__/user/user.e2e.ts

@@ -6,6 +6,8 @@ import ava from 'ava';
 import {
   createTestingApp,
   getPublicUserById,
+  smallestGif,
+  smallestPng,
   TestingApp,
   updateAvatar,
 } from '../utils';
@@ -27,7 +29,9 @@ test('should be able to upload user avatar', async t => {
   const { app } = t.context;
 
   await app.signup();
-  const avatar = Buffer.from('test');
+  const avatar = await fetch(smallestPng)
+    .then(res => res.arrayBuffer())
+    .then(b => Buffer.from(b));
   const res = await updateAvatar(app, avatar);
 
   t.is(res.status, 200);
@@ -36,19 +40,23 @@ test('should be able to upload user avatar', async t => {
 
   const avatarRes = await app.GET(new URL(avatarUrl).pathname);
 
-  t.deepEqual(avatarRes.body, Buffer.from('test'));
+  t.deepEqual(avatarRes.body, avatar);
 });
 
 test('should be able to update user avatar, and invalidate old avatar url', async t => {
   const { app } = t.context;
 
   await app.signup();
-  const avatar = Buffer.from('test');
+  const avatar = await fetch(smallestPng)
+    .then(res => res.arrayBuffer())
+    .then(b => Buffer.from(b));
   let res = await updateAvatar(app, avatar);
 
   const oldAvatarUrl = res.body.data.uploadAvatar.avatarUrl;
 
-  const newAvatar = Buffer.from('new');
+  const newAvatar = await fetch(smallestGif)
+    .then(res => res.arrayBuffer())
+    .then(b => Buffer.from(b));
   res = await updateAvatar(app, newAvatar);
   const newAvatarUrl = res.body.data.uploadAvatar.avatarUrl;
 
@@ -58,14 +66,16 @@ test('should be able to update user avatar, and invalidate old avatar url', asyn
   t.is(avatarRes.status, 404);
 
   const newAvatarRes = await app.GET(new URL(newAvatarUrl).pathname);
-  t.deepEqual(newAvatarRes.body, Buffer.from('new'));
+  t.deepEqual(newAvatarRes.body, newAvatar);
 });
 
 test('should be able to get public user by id', async t => {
   const { app } = t.context;
 
   const u1 = await app.signup();
-  const avatar = Buffer.from('test');
+  const avatar = await fetch(smallestPng)
+    .then(res => res.arrayBuffer())
+    .then(b => Buffer.from(b));
   await updateAvatar(app, avatar);
   const u2 = await app.signup();
 

packages/backend/server/src/__tests__/utils/blobs.ts

@@ -3,6 +3,10 @@ import { type Blob } from '@prisma/client';
 import { TestingApp } from './testing-app';
 import { TEST_LOG_LEVEL } from './utils';
 
+export const smallestPng =
+  'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAgAAAAIAQMAAAD+wSzIAAAABlBMVEX///+/v7+jQ3Y5AAAADklEQVQI12P4AIX8EAgALgAD/aNpbtEAAAAASUVORK5CYII';
+export const smallestGif = 'data:image/gif;base64,R0lGODlhAQABAAAAACw=';
+
 export async function listBlobs(
   app: TestingApp,
   workspaceId: string