File validation using Multer - Expressjs - node.js

Question

I have a form which have multiple fields one of them is file field for uploading image.
name = 'john doe'
location = 'Some location'
image = (binary)
My question is how do I validate this image file for both the times i.e CREATE AND UPDATE.
For create, every field is mandatory but for edit, user might not want to update image but only text fields hence he won't select an image file
router.post('/user', upload.single('image'), userRoute);
I have made a middleware like this but this does not give proper validation result. Let's assume that user has selected an image and pressed the submit button then I will get the like this in req.file.
{ fieldname: 'image',
originalname: 'images (2).jpg',
encoding: '7bit',
mimetype: 'image/jpeg',
destination: 'uploads/top-level',
filename: 'images (2)-1583345397445.jpg',
path: 'uploads\\top-level\\images (2)-1583345397445.jpg',
size: 33766 }
which make sense but suppose user selected some zip file which is not a file type which I want user to submit hence I have to catch it and show it to user that the file type is not an image. Let me know if i can do using above mentioned middleware.
router.post('/user', userRoute);
and i userRoute function I wrote something like this to catch the error
upload(req, res, function (err) {
if (err instanceof multer.MulterError) {
// catch error and show to user
} else if (err) {
// catch error and show to user here also
}
// Logic goes here
// and we get the req.body here
})
this is good enough for create where every field is mandatory
But for edit how can I save data to database if user is not updating image which means I am getting only two fields
name
location
If user is selecting image then I will save otherwise i will skip image and save only two fields. HOW can i achieve this and if user is not selecting correct image type then i will have to show error to user.
here is the multer code
var upload = multer({
storage: multer.diskStorage({
destination: (req, file, cb) => {
cb(null, 'uploads/top-level')
},
filename: function (req, file, cb) {
cb(null, file.originalname.split('.')[0] + '-' + Date.now() + path.extname(file.originalname))
}
}),
fileFilter: (req, file, cb) => {
if (file.mimetype == "image/png" || file.mimetype == "image/jpg" || file.mimetype == "image/jpeg") {
cb(null, true);
} else {
return cb(null, false);
}
}
});

Answer 1

First of all : You should have validation on both front & back ends in
order to provide the best experience possible and avoid "stupid"
errors which can (and will) ultimately become flaws just waiting to be
exploited by anyone that gets it.
Second : YOU NEVER SHOW ERRORS TO CLIENTS (EVER)..consider using the
connect-flash middleware to send a flash message either in
notifications or anywhere in your app(check docs for flash()).
On the front-end , you should block uploads of filetypes by extensions which is pretty easy either on native html or through JS ( you didn't specify your frontend so I will skip this part for the sake of clarity ).
On the backend , you can check on the "req.file.mimetype" to see if it's in an array of extensions allowed by your upload functionality.
something like this:
var authorizedMimeTypes=['jpg','jpeg',...];
if(req.file.mimetype in authorizedMimeTypes){
//your code goes here..
}else{
//your error code goes here..
};