feat: implement file upload with S3 storage (#2996)

maxgfr · web-flow · commit 20553d5c799d · 2026-03-16T16:58:24.000Z
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
@@ -20,12 +20,17 @@ jobs:
       EGAPRO_PROCONNECT_CLIENT_SECRET: ${{ secrets.EGAPRO_PROCONNECT_CLIENT_SECRET }}
       EGAPRO_PROCONNECT_ISSUER: ${{ secrets.EGAPRO_PROCONNECT_ISSUER }}
       EGAPRO_WEEZ_API_URL: ${{ secrets.EGAPRO_WEEZ_API_URL }}
-      SKIP_ENV_VALIDATION: "1"
+      EGAPRO_SUIT_API_URL: ${{ secrets.EGAPRO_SUIT_API_URL }}
+      S3_ENDPOINT: http://localhost:9000
+      S3_REGION: us-east-1
+      S3_ACCESS_KEY_ID: minioadmin
+      S3_SECRET_ACCESS_KEY: minioadmin
+      S3_BUCKET_NAME: egapro-dev-app
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Start services
-        run: docker compose up -d db
+        run: docker compose up -d
       - uses: pnpm/action-setup@v4
       - name: Set up Node
         uses: actions/setup-node@v4
diff --git a/.kontinuous/env/dev/templates/s3.configmap.yaml b/.kontinuous/env/dev/templates/s3.configmap.yaml
@@ -0,0 +1,8 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: s3
+data:
+  S3_ENDPOINT: "https://s3.gra.io.cloud.ovh.net"
+  S3_REGION: "gra"
+  S3_BUCKET_NAME: "egapro-dev-app"
diff --git a/.kontinuous/env/dev/templates/s3.sealed-secret.yaml b/.kontinuous/env/dev/templates/s3.sealed-secret.yaml
@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  annotations:
+    sealedsecrets.bitnami.com/cluster-wide: 'true'
+  name: s3
+spec:
+  encryptedData:
+    S3_ACCESS_KEY_ID: AgCvuM12JZFMjJ8KTDIz3IXXeWj99izf3AJDRE7lJZlYQf0QjpgTbggrpxecnf4R7LWfFDWKj3FZXCJuimYXd0D2YvE7Aylpxj/pLC/AlfUX0UGyvBLoOduR8Wy7wExulu4yTmepApcLktFYKySV9YGG+kxPpIqvtK1BJXZWuJ2gNwwvkGXJufrH/BB3cdtYxaEyx4hrYK0TyN88y6xnl95tX63LHv/0aUI3rFYukn44BOjtBVdYEKNWF8le9wcIFYcvrYqvEeKQ/V5GI8WvByhhwcCiVo8uuG4+S//34L5KXKdocsT1dqStkog6EL+URBhys1PqUIvjexjC1YOPMVrSUrRZ0+lYHt3o0bZ1HTtG3gb/sGrVnaM1XdEHkEVNLtvirYTur/KVcjRlJ2pWMFZP18h0Trd0a8RJOvzlgxIKMpMTg8lgdUfFixqQUMl8dWywWT8PIsDdeZyYamHdm1Bh5svU9/qvfcZBzxtivZ4xErcTG09f0EafupocI0mkzhonPLaoDCWsrVsihubVo5z/6KSxRqDd/1xEv8+I+y+3rrPVn8yPZWxFjjfl8TkSx5kp4FlgwpwTK3YhFtBl8JEv5c0D/1yB6SsyPXa2/6olIe8keQI1sH21NeBxJ5WcnMaq95lSz43c9Q4ZY4oj9nAkYuvFprPDF79Lrei1r9UJ6KCBBYwWQmJecLhzx2522AiQf+S6IorprNPJ3OzI6pHrLs6OX50pwh/oVO6IGKK1JA==
+    S3_SECRET_ACCESS_KEY: AgCmuD8F6sQ3AJJO4L4RybxBULCIst9LJLhK4C1AvOOoqkG+Ub5rkLJncQXpMpJKjJx/pLmHLfCQyVRVBamMbzZ5ll7KxukMacXHvdP5VxQXsAiM6AH61DyYk0PEXqPvG2YsMLPz4o7y6qs0dTZ7AcBwgX0k1t/uruI+BWenmihv09xH/EEUwZNAG6mmpc6Xw93sXiNOiWMxidBdUyWKTK3yJq6zzDWytVejHTwPztjwx4+GQDs11U5SnXKqnuxEkVDTyHMmwgckdKNkNVGIRf5hborklqYipEznt+2SiQiIwczrEeF/U+ybRx7BvWXjmWUkLfZul12cvgRW/5JwRe8RfYs7KT6sVoGue/Us65WtfGsbjPPMK63QA3gIO4UTX5jDpSL0GkwoQs+fDTcTJIIJMcOAeMUV0fsPyjVvl/ug7BCz8NZncsO6DWeO8GOXtrfrnvNkmDIWk3GXKPapXEzf0ptnmXu0PSf/fow266i6oaQN+R0Z9z/RtiDIY2ztNkbSNHk1xHnKWdznWSMNrNgNsrSSteQSUifvbbaZvI3I57SuD734RfEb3/rs6IWC6PKF8oL2kTlw6284CvKX2Qpu7PWZ7m+LxI5O9s1TQ9czsUR9mQE05HYIDmNlC8beD9AkvYRwpaALyXQ1k35L9wLR9MjxBm/YmQ6SENegtEezU4vrdo2OB4IgxmKCoMbdyJMVRq59UdBCdLjSR9Udogbd0ZMDT14f7b7pQXyTOzmHzw==
+  template:
+    metadata:
+      annotations:
+        sealedsecrets.bitnami.com/cluster-wide: 'true'
+      name: s3
+    type: Opaque
diff --git a/.kontinuous/env/preprod/templates/s3.configmap.yaml b/.kontinuous/env/preprod/templates/s3.configmap.yaml
@@ -0,0 +1,8 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: s3
+data:
+  S3_ENDPOINT: "https://s3.gra.io.cloud.ovh.net"
+  S3_REGION: "gra"
+  S3_BUCKET_NAME: "egapro-preprod-app"
diff --git a/.kontinuous/env/preprod/templates/s3.sealed-secret.yaml b/.kontinuous/env/preprod/templates/s3.sealed-secret.yaml
@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  annotations:
+    sealedsecrets.bitnami.com/cluster-wide: 'true'
+  name: s3
+spec:
+  encryptedData:
+    S3_ACCESS_KEY_ID: AgCvuM12JZFMjJ8KTDIz3IXXeWj99izf3AJDRE7lJZlYQf0QjpgTbggrpxecnf4R7LWfFDWKj3FZXCJuimYXd0D2YvE7Aylpxj/pLC/AlfUX0UGyvBLoOduR8Wy7wExulu4yTmepApcLktFYKySV9YGG+kxPpIqvtK1BJXZWuJ2gNwwvkGXJufrH/BB3cdtYxaEyx4hrYK0TyN88y6xnl95tX63LHv/0aUI3rFYukn44BOjtBVdYEKNWF8le9wcIFYcvrYqvEeKQ/V5GI8WvByhhwcCiVo8uuG4+S//34L5KXKdocsT1dqStkog6EL+URBhys1PqUIvjexjC1YOPMVrSUrRZ0+lYHt3o0bZ1HTtG3gb/sGrVnaM1XdEHkEVNLtvirYTur/KVcjRlJ2pWMFZP18h0Trd0a8RJOvzlgxIKMpMTg8lgdUfFixqQUMl8dWywWT8PIsDdeZyYamHdm1Bh5svU9/qvfcZBzxtivZ4xErcTG09f0EafupocI0mkzhonPLaoDCWsrVsihubVo5z/6KSxRqDd/1xEv8+I+y+3rrPVn8yPZWxFjjfl8TkSx5kp4FlgwpwTK3YhFtBl8JEv5c0D/1yB6SsyPXa2/6olIe8keQI1sH21NeBxJ5WcnMaq95lSz43c9Q4ZY4oj9nAkYuvFprPDF79Lrei1r9UJ6KCBBYwWQmJecLhzx2522AiQf+S6IorprNPJ3OzI6pHrLs6OX50pwh/oVO6IGKK1JA==
+    S3_SECRET_ACCESS_KEY: AgCmuD8F6sQ3AJJO4L4RybxBULCIst9LJLhK4C1AvOOoqkG+Ub5rkLJncQXpMpJKjJx/pLmHLfCQyVRVBamMbzZ5ll7KxukMacXHvdP5VxQXsAiM6AH61DyYk0PEXqPvG2YsMLPz4o7y6qs0dTZ7AcBwgX0k1t/uruI+BWenmihv09xH/EEUwZNAG6mmpc6Xw93sXiNOiWMxidBdUyWKTK3yJq6zzDWytVejHTwPztjwx4+GQDs11U5SnXKqnuxEkVDTyHMmwgckdKNkNVGIRf5hborklqYipEznt+2SiQiIwczrEeF/U+ybRx7BvWXjmWUkLfZul12cvgRW/5JwRe8RfYs7KT6sVoGue/Us65WtfGsbjPPMK63QA3gIO4UTX5jDpSL0GkwoQs+fDTcTJIIJMcOAeMUV0fsPyjVvl/ug7BCz8NZncsO6DWeO8GOXtrfrnvNkmDIWk3GXKPapXEzf0ptnmXu0PSf/fow266i6oaQN+R0Z9z/RtiDIY2ztNkbSNHk1xHnKWdznWSMNrNgNsrSSteQSUifvbbaZvI3I57SuD734RfEb3/rs6IWC6PKF8oL2kTlw6284CvKX2Qpu7PWZ7m+LxI5O9s1TQ9czsUR9mQE05HYIDmNlC8beD9AkvYRwpaALyXQ1k35L9wLR9MjxBm/YmQ6SENegtEezU4vrdo2OB4IgxmKCoMbdyJMVRq59UdBCdLjSR9Udogbd0ZMDT14f7b7pQXyTOzmHzw==
+  template:
+    metadata:
+      annotations:
+        sealedsecrets.bitnami.com/cluster-wide: 'true'
+      name: s3
+    type: Opaque
diff --git a/.kontinuous/env/prod/templates/s3.configmap.yaml b/.kontinuous/env/prod/templates/s3.configmap.yaml
@@ -0,0 +1,8 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: s3
+data:
+  S3_ENDPOINT: "https://s3.gra.io.cloud.ovh.net"
+  S3_REGION: "gra"
+  S3_BUCKET_NAME: "egapro-prod-app"
diff --git a/.kontinuous/env/prod/templates/s3.sealed-secret.yaml b/.kontinuous/env/prod/templates/s3.sealed-secret.yaml
@@ -0,0 +1,17 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  annotations:
+    sealedsecrets.bitnami.com/namespace-wide: 'true'
+  name: s3
+  namespace: egapro
+spec:
+  encryptedData:
+    S3_ACCESS_KEY_ID: AgBK5bokpB3UTuDmFtw8xMdtjF/imLEYpJNhVHLADg/FdGD0xuZHlW8h70+af3aP+3QazEqS8e6AtwbbIkDnoh8LVTld1QZOvGK8RmtM3ie1h1lG2UTwy1QWraRrLsY4jAVBeoS6nHpxgnKA2LW92SaGBsSRANwlEleV3Mtf7cuVk/sa7hroHxDwAApfG5xxEqQR/1yCyWupCJWSaFjN3rlC8qPjZ8PB4hcY92b9By0NvmFBgXEWQqzJdVvghpyHjbe/YUhusLrfJI6xbowJNNl0F7qY8vH0wNlEvePSLPrlZeNvaBjPD2UAW66aGiilOcz98CEATp6/D66HhFCdZ4xVl/SEqLRNcaZrhaX1fJnMybgPI8/SyRPtubwanCIHlQbJZsj3inhnJDgpz8Lg4Gk6mvzzJkbMN/UciAKP3K9RqoX2LUZaambAUO7t1H8J4CdbfVcgl3pr6Id9N015x+wRvJqGxCQA70RcjCE661gOfnUU5xWUjrfn6MD1TcnCRkCv6LqFQWfzTRQUJKnFUcZSem+p1xSUqiMvnGjXWp4g2Vz3lwpuUj74CDwxfU1hYZkyDmtD4ChQOAQRZ8H800e3s9xkQ1LO1vEILoG0EmWe3acZmDpkS/DMvci2Y16m+Y348cKqL2/U9ys+A9s35cWbeXVaVSRbvMWoGKHfYMtvNzfj9GE04X9TMnfJN1Z2Cy58jq3MfUl3GgPfQ4ioRFfKB04L8vO4kvIYAfA3WIBFyQ==
+    S3_SECRET_ACCESS_KEY: AgAJrEjoz2aTGcXdB41mfk1hj2n6hANrH/tFZ8h3ruCAzKO3HrQn0VzOnafeID0pojFXzKi+I/FdADA6XHzs13VHjv0e9VgvYNxNa+DRpI8WK+8cPlAzyC9+B2FX/gActypBWJWlQfw/L5ZNScDKLW/xKl/7iNRmayNxEW9xaCyQui6kI1juIBmicjx8RDrwhxBe5rSS7wI2gKILb/Lvv+vmpfObnGAmumooyVZPJpnozBaW0mcdfXd3IGCTK+AVz/evv4tadpGBGNy7JVFF3PMuj4ldYbI1xtrpY7j3WL2LaBoX9BsqdyAPaQTvyd7rhLjPUU3AIeCrmUt+yDfmWlOI3ZllaNm3VaVppqL1Q54d5NgCax1k6DteMNGzBtMCvb7mxaqAdeRia0vb+CnFPqPVACmnruUO45YXqMfyli9SNFjm4S/gIP21ZKQJFzO5SrLG3xpFtwnl8L2sBLAzpvs5c7oVpV8GCr8GAnPhs/7CTvj81qilggxvZ7xNzybUWOo/6rsM39ufVHVAKB0ie0qPDZ+Id+RXwd8Mjwi+aPb7KgDyDk9HoIyQCmTSK3OHgxn4+OiNXpmaVCEcPU63sZ54Lo0bVtaNwkEyn9XTjbFWmMrZfQBGvBY7bBTGWCJxuWTN2avKN4AWkITxmD8oMEjJpezLpk0LjaX9ek2hA4ZwuQSWI/vQJJzEiHFoDaCWVaQtPGvWIMaokvBTSRg6VsCBX3Tqjch866Fo+0JKgSz4Hg==
+  template:
+    metadata:
+      annotations:
+        sealedsecrets.bitnami.com/namespace-wide: 'true'
+      name: s3
+    type: Opaque
diff --git a/.kontinuous/values.yaml b/.kontinuous/values.yaml
@@ -21,6 +21,10 @@ app:
         name: "suit"
     - secretRef:
         name: "next-auth"
+    - configMapRef:
+        name: "s3"
+    - secretRef:
+        name: "s3"
   env:
     - name: POSTGRES_HOST
       valueFrom:
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -30,5 +30,33 @@ services:
     command: >
       sh -c "corepack enable && pnpm --filter app db:push"
 
+  minio:
+    image: minio/minio
+    ports:
+      - 9000:9000
+      - 9001:9001
+    environment:
+      MINIO_ROOT_USER: minioadmin
+      MINIO_ROOT_PASSWORD: minioadmin
+    volumes:
+      - miniodata:/data
+    command: server /data --console-address ":9001"
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  minio-init:
+    image: minio/mc
+    depends_on:
+      minio:
+        condition: service_healthy
+    entrypoint: >
+      sh -c "mc alias set local http://minio:9000 minioadmin minioadmin &&
+             mc mb --ignore-existing local/egapro-dev-app &&
+             mc anonymous set none local/egapro-dev-app"
+
 volumes:
   pgdata:
+  miniodata:
diff --git a/packages/app/.env.example b/packages/app/.env.example
@@ -9,4 +9,10 @@ SENTRY_AUTH_TOKEN=""
 NEXT_PUBLIC_SENTRY_DSN=""
 NEXT_PUBLIC_MATOMO_URL=""
 NEXT_PUBLIC_MATOMO_SITE_ID=""
-NEXT_PUBLIC_EGAPRO_ENV="dev"
+NEXT_PUBLIC_EGAPRO_ENV="dev"
+EGAPRO_SUIT_API_URL=""
+S3_ENDPOINT="http://localhost:9000"
+S3_REGION="us-east-1"
+S3_ACCESS_KEY_ID="minioadmin"
+S3_SECRET_ACCESS_KEY="minioadmin"
+S3_BUCKET_NAME="egapro-dev-app"
diff --git a/packages/app/package.json b/packages/app/package.json
@@ -30,6 +30,7 @@
 	},
 	"dependencies": {
 		"@auth/drizzle-adapter": "^1.11.1",
+		"@aws-sdk/client-s3": "^3.1006.0",
 		"@gouvfr/dsfr": "^1.14.3",
 		"@react-pdf/renderer": "^4.3.2",
 		"@sentry/nextjs": "^10.39.0",
diff --git a/packages/app/src/env.js b/packages/app/src/env.js
@@ -46,6 +46,11 @@ export const env = createEnv({
 		EGAPRO_PROCONNECT_ISSUER: z.string().url(),
 		EGAPRO_WEEZ_API_URL: z.string().url(),
 		EGAPRO_SUIT_API_URL: z.string().url(),
+		S3_ENDPOINT: z.string().url(),
+		S3_REGION: z.string(),
+		S3_ACCESS_KEY_ID: z.string(),
+		S3_SECRET_ACCESS_KEY: z.string(),
+		S3_BUCKET_NAME: z.string(),
 		NEXTAUTH_URL: z.string().url(),
 	},
 
@@ -79,6 +84,11 @@ export const env = createEnv({
 		EGAPRO_PROCONNECT_ISSUER: process.env.EGAPRO_PROCONNECT_ISSUER,
 		EGAPRO_WEEZ_API_URL: process.env.EGAPRO_WEEZ_API_URL,
 		EGAPRO_SUIT_API_URL: process.env.EGAPRO_SUIT_API_URL,
+		S3_ENDPOINT: process.env.S3_ENDPOINT,
+		S3_REGION: process.env.S3_REGION,
+		S3_ACCESS_KEY_ID: process.env.S3_ACCESS_KEY_ID,
+		S3_SECRET_ACCESS_KEY: process.env.S3_SECRET_ACCESS_KEY,
+		S3_BUCKET_NAME: process.env.S3_BUCKET_NAME,
 		NEXTAUTH_URL: process.env.NEXTAUTH_URL,
 		NEXT_PUBLIC_EGAPRO_ENV: process.env.NEXT_PUBLIC_EGAPRO_ENV,
 		NEXT_PUBLIC_SENTRY_DSN: process.env.NEXT_PUBLIC_SENTRY_DSN,
diff --git a/packages/app/src/instrumentation.ts b/packages/app/src/instrumentation.ts
@@ -3,6 +3,8 @@ import * as Sentry from "@sentry/nextjs";
 export async function register() {
 	if (process.env.NEXT_RUNTIME === "nodejs") {
 		await import("./sentry.server.config");
+		const { ensureBucket } = await import("~/server/services/s3");
+		await ensureBucket();
 	}
 
 	if (process.env.NEXT_RUNTIME === "edge") {
diff --git a/packages/app/src/server/services/__tests__/fileValidation.test.ts b/packages/app/src/server/services/__tests__/fileValidation.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, it } from "vitest";
+import { validatePdf } from "../fileValidation";
+
+describe("validatePdf", () => {
+	it("returns valid for a proper PDF buffer", () => {
+		const buffer = Buffer.from("%PDF-1.4 some content here");
+		const result = validatePdf(buffer);
+		expect(result.valid).toBe(true);
+		expect(result.error).toBeUndefined();
+	});
+
+	it("returns invalid for an empty buffer", () => {
+		const buffer = Buffer.alloc(0);
+		const result = validatePdf(buffer);
+		expect(result.valid).toBe(false);
+		expect(result.error).toBe("Le fichier est vide.");
+	});
+
+	it("returns invalid for a buffer exceeding 10 MB", () => {
+		const buffer = Buffer.alloc(10 * 1024 * 1024 + 1);
+		// Set PDF magic bytes so it doesn't fail on that check first
+		buffer.write("%PDF-");
+		const result = validatePdf(buffer);
+		expect(result.valid).toBe(false);
+		expect(result.error).toContain("10 Mo");
+	});
+
+	it("returns invalid for a non-PDF file", () => {
+		const buffer = Buffer.from("PK\x03\x04 not a pdf");
+		const result = validatePdf(buffer);
+		expect(result.valid).toBe(false);
+		expect(result.error).toBe("Le fichier n'est pas un PDF valide.");
+	});
+
+	it("returns invalid for a buffer with wrong magic bytes", () => {
+		const buffer = Buffer.from("<html>not a pdf</html>");
+		const result = validatePdf(buffer);
+		expect(result.valid).toBe(false);
+		expect(result.error).toBe("Le fichier n'est pas un PDF valide.");
+	});
+
+	it("returns valid for exactly 10 MB PDF", () => {
+		const buffer = Buffer.alloc(10 * 1024 * 1024);
+		buffer.write("%PDF-");
+		const result = validatePdf(buffer);
+		expect(result.valid).toBe(true);
+	});
+});
diff --git a/packages/app/src/server/services/__tests__/s3.test.ts b/packages/app/src/server/services/__tests__/s3.test.ts
@@ -0,0 +1,94 @@
+import { describe, expect, it, vi } from "vitest";
+
+const sendMock = vi.fn().mockResolvedValue({
+	Body: {
+		transformToWebStream: () => new ReadableStream(),
+	},
+	ContentType: "application/pdf",
+});
+
+vi.mock("@aws-sdk/client-s3", () => {
+	return {
+		S3Client: class {
+			send = sendMock;
+		},
+		PutObjectCommand: vi.fn(),
+		GetObjectCommand: vi.fn(),
+		DeleteObjectCommand: vi.fn(),
+		HeadBucketCommand: vi.fn(),
+		CreateBucketCommand: vi.fn(),
+	};
+});
+
+describe("s3 service", () => {
+	describe("ensureBucket", () => {
+		it("does nothing when bucket already exists", async () => {
+			sendMock.mockResolvedValueOnce({});
+			const { ensureBucket } = await import("../s3");
+			await ensureBucket();
+			const { HeadBucketCommand } = await import("@aws-sdk/client-s3");
+			expect(HeadBucketCommand).toHaveBeenCalled();
+		});
+
+		it("creates bucket when it does not exist", async () => {
+			const notFoundError = new Error("NotFound");
+			Object.assign(notFoundError, {
+				$metadata: { httpStatusCode: 404 },
+			});
+			sendMock.mockRejectedValueOnce(notFoundError);
+			sendMock.mockResolvedValueOnce({});
+
+			const { ensureBucket } = await import("../s3");
+			await ensureBucket();
+
+			const { CreateBucketCommand } = await import("@aws-sdk/client-s3");
+			expect(CreateBucketCommand).toHaveBeenCalled();
+		});
+	});
+
+	describe("buildObjectKey", () => {
+		it("builds the correct S3 object key", async () => {
+			const { buildObjectKey } = await import("../s3");
+			const key = buildObjectKey("123456789", 2027, "abc-def-123");
+			expect(key).toBe("123456789/2027/abc-def-123.pdf");
+		});
+	});
+
+	describe("uploadFile", () => {
+		it("sends a PutObjectCommand", async () => {
+			const { PutObjectCommand } = await import("@aws-sdk/client-s3");
+			const { uploadFile } = await import("../s3");
+
+			await uploadFile("key.pdf", Buffer.from("test"), "application/pdf");
+
+			expect(PutObjectCommand).toHaveBeenCalledWith(
+				expect.objectContaining({
+					Key: "key.pdf",
+					ContentType: "application/pdf",
+				}),
+			);
+		});
+	});
+
+	describe("getFile", () => {
+		it("returns body and content type", async () => {
+			const { getFile } = await import("../s3");
+			const result = await getFile("key.pdf");
+			expect(result.contentType).toBe("application/pdf");
+			expect(result.body).toBeInstanceOf(ReadableStream);
+		});
+	});
+
+	describe("deleteFile", () => {
+		it("sends a DeleteObjectCommand", async () => {
+			const { DeleteObjectCommand } = await import("@aws-sdk/client-s3");
+			const { deleteFile } = await import("../s3");
+
+			await deleteFile("key.pdf");
+
+			expect(DeleteObjectCommand).toHaveBeenCalledWith(
+				expect.objectContaining({ Key: "key.pdf" }),
+			);
+		});
+	});
+});
diff --git a/packages/app/src/server/services/fileValidation.ts b/packages/app/src/server/services/fileValidation.ts
@@ -0,0 +1,35 @@
+import "server-only";
+
+const MAX_FILE_SIZE = 10 * 1024 * 1024;
+const PDF_MAGIC_BYTES = [0x25, 0x50, 0x44, 0x46, 0x2d]; // %PDF-
+
+type ValidationResult = {
+	valid: boolean;
+	error?: string;
+};
+
+export function validatePdf(buffer: Buffer): ValidationResult {
+	if (buffer.length === 0) {
+		return { valid: false, error: "Le fichier est vide." };
+	}
+
+	if (buffer.length > MAX_FILE_SIZE) {
+		return {
+			valid: false,
+			error: "Le fichier dépasse la taille maximale autorisée de 10 Mo.",
+		};
+	}
+
+	const hasPdfSignature = PDF_MAGIC_BYTES.every(
+		(byte, index) => buffer[index] === byte,
+	);
+
+	if (!hasPdfSignature) {
+		return {
+			valid: false,
+			error: "Le fichier n'est pas un PDF valide.",
+		};
+	}
+
+	return { valid: true };
+}
diff --git a/packages/app/src/server/services/s3.ts b/packages/app/src/server/services/s3.ts
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
