feat: белый список форматов + сводка батча по типам

deploy/services/upload.py

@@ -4,6 +4,15 @@ from db import documents, contracts, supplements
 from .parse import parse_file
 
 MAX_FILE_SIZE = 100 * 1024 * 1024  # 100 MB
+ALLOWED_EXTENSIONS = {"pdf", "docx", "doc", "zip"}
+
+
+def _check_format(filename: str) -> str | None:
+    """Validate file extension. Returns error string or None."""
+    ext = filename.rsplit(".", 1)[-1].lower() if "." in filename else ""
+    if ext not in ALLOWED_EXTENSIONS:
+        return f"unsupported format: .{ext} (allowed: {', '.join(sorted(ALLOWED_EXTENSIONS))})"
+    return None
 
 
 # ── Чистые функции (тестируемы без HTTP) ──────────────────────
@@ -77,6 +86,10 @@ def store_document(filename: str, file_data: bytes, contract_id: str = "",
     if not filename or not file_data:
         return {"ok": False, "error": "no file"}
 
+    fmt_err = _check_format(filename)
+    if fmt_err:
+        return {"ok": False, "error": fmt_err}
+
     import hashlib
     content_hash = hashlib.sha256(file_data).hexdigest()