fix: validate file contents

[andrewleith]

Summary | Résumé

This pull request improves validation for document uploads by ensuring that empty files are not accepted and enhances error messages for invalid base64 data. The main changes include stricter base64 decoding, explicit empty file checks, and updated tests to reflect the new validation logic.

Validation improvements:

• Updated decode_personalisation_files in validators.py to use base64.b64decode with validate=True for stricter base64 validation.
• Added a check to reject empty files, appending a validation error if a decoded file is empty.

Test enhancements:

• Expanded test cases in test_post_notification_with_document_upload_not_base64_file to cover empty file uploads and provide more descriptive error messages.
• Updated assertions in tests to match the improved error message formats, ensuring tests align with stricter validation logic.

Related Issues | Cartes liées

• Attachment concerns from our users (API file attachment) notification-planning#3438

Test instructions | Instructions pour tester la modification

TODO: Fill in test instructions for the reviewer.

Release Instructions | Instructions pour le déploiement

None.

Reviewer checklist | Liste de vérification du réviseur

• This PR does not break existing functionality.
• This PR does not violate GCNotify's privacy policies.
• This PR does not raise new security concerns. Refer to our GC Notify Risk Register document on our Google drive.
• This PR does not significantly alter performance.
• Additional required documentation resulting of these changes is covered (such as the README, setup instructions, a related ADR or the technical documentation).

⚠ If boxes cannot be checked off before merging the PR, they should be moved to the "Release Instructions" section with appropriate steps required to verify before release. For example, changes to celery code may require tests on staging to verify that performance has not been affected.

[Copilot]

Pull request overview

This PR tightens document-upload validation in the notification API by making base64 decoding stricter and rejecting empty decoded files, with tests updated to reflect the new validation behavior.

Changes:

• Use base64.b64decode(..., validate=True) in decode_personalisation_files for stricter base64 validation.
• Add an explicit check to reject empty decoded files (len(...) == 0) with a clear validation error.
• Update v2 notification tests to cover additional invalid base64 cases and empty uploads.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
app/notifications/validators.py	Stricter base64 decoding and explicit empty-file rejection during personalisation file decoding.
tests/app/v2/notifications/test_post_notifications.py	Expanded/updated test cases and assertions to match the new validation messages and empty-file behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.