feat(plugins): catalog images and purchase receipt uploads

Catalog items can store up to three photos; remote tenants attach a receipt on pending requests.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/plugins/plugin-store.controller.ts

@@ -1,8 +1,30 @@
-import { Body, Controller, Get, Param, Patch, Post, Query, UseGuards } from '@nestjs/common';
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  Get,
+  Param,
+  Patch,
+  Post,
+  Query,
+  UploadedFile,
+  UseGuards,
+  UseInterceptors,
+} from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { FileInterceptor } from '@nestjs/platform-express';
+import { diskStorage } from 'multer';
+import { extname } from 'path';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
 import { PermissionsGuard } from '../auth/permissions.guard';
 import { RequirePermissions } from '../auth/permissions.decorator';
 import { CurrentUser } from '../auth/current-user.decorator';
+import {
+  IMAGE_MIME,
+  PLUGIN_IMAGES_DIR,
+  ensureUploadsDirs,
+  publicApiBase,
+} from '../uploads/uploads.util';
 import {
   ApprovePurchaseDto,
   CreateCatalogSettingDto,
@@ -13,7 +35,10 @@ import { PluginStoreService } from './plugin-store.service';
 @Controller('plugins/store')
 @UseGuards(JwtAuthGuard, PermissionsGuard)
 export class PluginStoreController {
-  constructor(private readonly store: PluginStoreService) {}
+  constructor(
+    private readonly store: PluginStoreService,
+    private readonly config: ConfigService,
+  ) {}
 
   @Get('catalog')
   @RequirePermissions('plugins:read')
@@ -21,6 +46,37 @@ export class PluginStoreController {
     return this.store.listCatalogAdmin();
   }
 
+  @Post('upload-image')
+  @RequirePermissions('plugins:write')
+  @UseInterceptors(
+    FileInterceptor('file', {
+      storage: diskStorage({
+        destination: (_req, _file, cb) => {
+          ensureUploadsDirs();
+          cb(null, PLUGIN_IMAGES_DIR);
+        },
+        filename: (_req, file, cb) => {
+          const safeExt = extname(file.originalname).toLowerCase() || '.png';
+          const name = `plugin_${Date.now()}_${Math.random().toString(36).slice(2, 8)}${safeExt}`;
+          cb(null, name);
+        },
+      }),
+      limits: { fileSize: 2 * 1024 * 1024 },
+      fileFilter: (_req, file, cb) => {
+        if (!IMAGE_MIME.test(file.mimetype)) {
+          cb(new BadRequestException('فقط تصویر (jpg/png/gif/webp/svg) مجاز است') as any, false);
+          return;
+        }
+        cb(null, true);
+      },
+    }),
+  )
+  uploadImage(@UploadedFile() file: Express.Multer.File) {
+    if (!file) throw new BadRequestException('فایل ارسال نشده است');
+    const base = publicApiBase(this.config);
+    return { url: `${base}/uploads/plugins/${file.filename}` };
+  }
+
   @Patch('catalog/:id')
   @RequirePermissions('plugins:write')
   saveItem(