WIP

src/State/DocumentUploadProcessor.php

@@ -64,6 +64,20 @@ final class DocumentUploadProcessor implements ProcessorInterface
             throw new BadRequestHttpException('A valid file is required in the "file" field.');
         }
 
+        $allowedMimeTypes = [
+            'application/pdf',
+            'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/bmp',
+            'text/plain', 'text/csv',
+            'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+            'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+            'application/msword', 'application/vnd.ms-excel',
+            'application/zip',
+        ];
+        $detectedMime = $file->getMimeType() ?: 'application/octet-stream';
+        if (!in_array($detectedMime, $allowedMimeTypes, true)) {
+            throw new BadRequestHttpException(sprintf('Type de fichier non autorisé : %s', $detectedMime));
+        }
+
         $document = new Document();
 
         // Metadata from form fields