WIP checkpoint: Address review feedback: Scaffold FastAPI backend project structure

backend/app/routers/assets.py

@@ -6,6 +6,7 @@ from fastapi import APIRouter, Depends, HTTPException, UploadFile, File, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.config import settings
 from app.database import get_db
 from app.dependencies import CurrentUser
 from app.models.asset import Asset, AssetType
@@ -40,8 +41,7 @@ class AssetResponse(BaseModel):
     created_at: str
     updated_at: str
 
-    class Config:
-        from_attributes = True
+    model_config = {"from_attributes": True}
 
 
 class AssetUpdate(BaseModel):
@@ -167,11 +167,24 @@ async def upload_asset_file(
     if asset is None or asset.owner_id != current_user.id:
         raise HTTPException(status_code=404, detail="Asset not found")
 
-    # TODO: Implement actual file upload logic (S3, local filesystem, etc.)
-    file_path = f"uploads/{asset_id}_{file.filename}"
+    # Sanitize filename to prevent path traversal
+    safe_filename = file.filename.replace("/", "_").replace("\\", "_") if file.filename else f"asset_{asset_id}"
+    file_path = f"uploads/{asset_id}_{safe_filename}"
+
+    # Validate file size against configured maximum
+    max_bytes = settings.MAX_UPLOAD_SIZE_MB * 1024 * 1024
+    content = await file.read()
+    file_size = len(content)
+    if file_size > max_bytes:
+        raise HTTPException(
+            status_code=413,
+            detail=f"File size {file_size} exceeds maximum allowed size {max_bytes} bytes",
+        )
+
+    # TODO: Implement actual file write logic (S3, local filesystem, etc.)
     asset.file_path = file_path
     asset.mime_type = file.content_type
-    asset.file_size = 0  # Will be updated after actual write
+    asset.file_size = file_size
 
     await db.commit()
     await db.refresh(asset)