fix(uploads): clear JSON Content-Type so multipart uploads set a boundary (#32)

[ClaydeCode]

Summary

Fixes #32 — uploading an image on the Public View page (and uploading a custom app on the Apps page) failed with a 422:

{"detail":[{"type":"missing","loc":["body","file"],"msg":"Field required","input":null}]}

Root cause

$http is the shared axios instance created in src/main.js with a default Content-Type: application/json. When a FormData body is sent under that default, axios' transformRequest serializes the FormData to a JSON string (lib/defaults/index.js: hasJSONContentType ? JSON.stringify(formDataToJSON(data)) : data). The body is no longer a FormData, so the browser never sets a multipart/form-data; boundary=... header and the backend finds no file part.

• src/views/Public.vue uploadAvatar never overrode the JSON default.
• src/views/Apps.vue uploadCustomApp set 'Content-Type': 'multipart/form-data' with no boundary — same failure mode.

Fix

Clear the per-request Content-Type on both upload calls ({ headers: { 'Content-Type': undefined } }). With no JSON content-type, axios keeps the raw FormData; in a standard browser env axios' xhr adapter then drops the header entirely (lib/helpers/resolveConfig.js: headers.setContentType(undefined) // Let the browser set it) so the browser sets the multipart boundary. axios normalizes header case, so Content-Type cancels the Content-type default.

Tests / docs

• New tests/unit/upload-content-type.spec.js drives the real uploadAvatar / uploadCustomApp methods with an injected $http mock and asserts they clear the Content-Type; a third test pins the axios behavior that makes undefined the correct value. Verified by mutation: reverting the override makes the tests fail.
• agents.md documents the upload gotcha under API Communication.

Local verification: test:unit (22 passing), lint clean, build succeeds.

Recommended reading order

1. src/views/Public.vue, src/views/Apps.vue — the fix
2. tests/unit/upload-content-type.spec.js — the guard
3. agents.md — the documented gotcha

Review panel

Ran three reviewers (adversarial always-on, plus test-adversary and DevEx since the diff adds real logic and tests). Security / DB / API-contract / UX did not fire — this is a client-side request-header change with no auth, schema, route, or visual surface.

• Adversarial (correctness): No blocking findings. Verified against axios 1.8.4 source that Content-Type: undefined drops the JSON default (case-insensitively) and that no other FormData/upload call sites exist. Raised the same test-teeth advisory as below.
• Test adversary: BLOCKING — the original test reconstructed axios inline and re-inlined the override, so deleting the fix from Public.vue/Apps.vue left all tests green (proven by mutation). Resolved in 7aa7e24: the tests now invoke the real component methods and assert on the config passed to $http; a mutation run confirms they fail when the override is removed. Advisory edge cases (multi-file loop, failure branch) — the multi-file path is now covered; the failure/doneCallback branches were left uncovered as out of scope for this fix.
• DevEx / readability: BLOCKING — same test-teeth issue, independently found; resolved by the same rewrite. Advisories: duplicate tests (now distinct — real methods, URLs, verbs), brittle deep axios import (confined to the one mechanism test with an explanatory comment), header-casing invisibility (fixed — noted in agents.md). Praised the naming, restraint on source comments, and doc placement.

🤖 Generated with Claude Code