Mobile Client Compatibility — Failed Attachment Handling (iOS/Android) #1874

Summary

This branch implements the server-side API contract for failed attachment handling following ClamAV pre-disk scanning, establishing the foundation for mobile client compatibility.

Changes Made

• Modified service/src/adapters/observations/adapters.observations.controllers.web.ts to handle ClamAV rejected attachments by storing a placeholder image (SecError.png) in place of the rejected file and returning a structured response including contentStored: false, error, and failures fields
• Added service/src/assets/SecError.png — placeholder image displayed when an attachment is rejected by ClamAV
• Merged ClamAV pre-disk scanning work from branch predisk-scanning-1756

Response Structure on Rejection

{
    "id": "",
    "fieldName": "",
    "observationFormId": "",
    "lastModified": "",
    "contentType": "",
    "name": "",
    "size": "",
    "oriented": "",
    "thumbnails": [],
    "contentStored": false,
    "url": "",
    "relativePath": "",
    "error": "File failed security scan",
    "failures": [
        {
            "file": "eicar.txt",
            "error": "File failed security scan"
        }
    ]
}

Testing

• Tested locally with clean file upload — success response correct
• Tested locally with eicar.txt — rejection response matches agreed structure
• Verified on test environment with ClamAV running

Dependencies

• Requires ClamAV running with CLAM_AV_URL env variable set
• Branched from develop with predisk-scanning-1756 merged in

Open Items

• iOS/Android client testing against new response structure pending
• Granular failure messaging on mobile TBD pending iOS/Android findings