Adds mime_type field to resource serializer

[oliverroick]

Proposed changes in this pull request

• This PR adds a temporary workaround to API: Resources uploaded via that API do not display image preview #1322 to ensure thumbnails are created for @SteadyCadence's imports. Proper handling of mime types should be implemented with Improve download processing #490.

When should this PR be merged

Soon; this is important to move forward with data imports.

Risks

None

Follow-up actions

None

Checklist (for reviewing)

General

• Is this PR explained thoroughly? All code changes must be accounted for in the PR description.
• Is the PR labeled correctly? It should have the migration label if a new migration is added.
• Is the risk level assessment sufficient? The risks section should contain all risks that might be introduced with the PR and which actions we need to take to mitigate these risks. Possible risks are database migrations, new libraries that need to be installed or changes to deployment scripts.

Functionality

• Are all requirements met? Compare implemented functionality with the requirements specification.
• Does the UI work as expected? There should be no Javascript errors in the console; all resources should load. There should be no unexpected errors. Deliberately try to break the feature to find out if there are corner cases that are not handled.

Code

• Do you fully understand the introduced changes to the code? If not ask for clarification, it might uncover ways to solve a problem in a more elegant and efficient way.
• Does the PR introduce any inefficient database requests? Use the debug server to check for duplicate requests.
• Are all necessary strings marked for translation? All strings that are exposed to users via the UI must be marked for translation.

Tests

• Are there sufficient test cases? Ensure that all components are tested individually; models, forms, and serializers should be tested in isolation even if a test for a view covers these components.
• If this is a bug fix, are tests for the issue in place? There must be a test case for the bug to ensure the issue won’t regress. Make sure that the tests break without the new code to fix the issue.
• If this is a new feature or a significant change to an existing feature? has the manual testing spreadsheet been updated with instructions for manual testing?

Security

• Confirm this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.
• Are all UI and API inputs run through forms or serializers?
• Are all external inputs validated and sanitized appropriately?
• Does all branching logic have a default case?
• Does this solution handle outliers and edge cases gracefully?
• Are all external communications secured and restricted to SSL?

Documentation

• Are changes to the UI documented in the platform docs? If this PR introduces new platform site functionality or changes existing ones, the changes must be documented in the Cadasta Platform Documentation.
• Are changes to the API documented in the API docs? If this PR introduces new API functionality or changes existing ones, the changes must be documented in the API docs.
• Are reusable components documented? If this PR introduces components that are relevant to other developers (for instance a mixin for a view or a generic form) they should be documented in the Wiki.

[seav]

The changes look good. But I think we may need tests for the following 2 cases:

1. Since you indicated in the serializer that the MIME type is not required, then there should be a test to check that you can create/update a resource that has no MIME type.
2. Since only images are expected to have thumbnails, should we have a test that if the specified MIME type is not an image (or is missing), then no thumbnail is created? (What about for the unlikely case that a file's MIME type was updated from a non-image type to an image type?)

[linzjax]

Does this address the issues that @amplifi raised here? #1322 (comment)

Resolving this issue will require adding a secure process by which we derive and/or verify the mimetype of the uploaded file, saving mimetype to the resources table in the db (and writing to S3 metadata if not already populated), quarantining files for which a user-specified mimetype doesn't match the derived mimetype and applying additional processing, then generating and displaying the appropriate preview image. Much of this is adjacent to #490.

[amplifi]

@linzjax It doesn't address the mime type security issues, but it's an early component for handling proper processing end-to-end. Good looking out!

[oliverroick]

@seav: I added two tests, one to verify that you can create a resource without specifying a mime type, and one to verify that no thumbnail is created for files other than images.

Since creating a thumbnail is handled in create_thumbnails, which is the same for creating and updating resources I don't think specific tests for updating the resource are necessary.

[seav]

@linzjax, 2nd review is all yours!

[linzjax]

Look good 👍