Validate amenity icon key against png files

src/main/kotlin/com/android/trisolarisserver/controller/RoomAmenities.kt

@@ -9,6 +9,7 @@ import com.android.trisolarisserver.repo.RoomTypeRepo
 import com.android.trisolarisserver.security.MyPrincipal
 import org.springframework.http.HttpStatus
 import org.springframework.security.core.annotation.AuthenticationPrincipal
+import org.springframework.beans.factory.annotation.Value
 import org.springframework.web.bind.annotation.DeleteMapping
 import org.springframework.web.bind.annotation.GetMapping
 import org.springframework.web.bind.annotation.PathVariable
@@ -19,6 +20,8 @@ import org.springframework.web.bind.annotation.RequestMapping
 import org.springframework.web.bind.annotation.ResponseStatus
 import org.springframework.web.bind.annotation.RestController
 import org.springframework.web.server.ResponseStatusException
+import java.nio.file.Files
+import java.nio.file.Paths
 import java.util.UUID
 
 @RestController
@@ -28,6 +31,8 @@ class RoomAmenities(
     private val roomTypeRepo: RoomTypeRepo,
     private val appUserRepo: AppUserRepo
 ) {
+    @Value("\${storage.icons.png.root:/home/androidlover5842/docs/icons/png}")
+    private lateinit var pngRoot: String
 
     @GetMapping
     fun listAmenities(
@@ -48,6 +53,7 @@ class RoomAmenities(
         if (roomAmenityRepo.existsByName(request.name)) {
             throw ResponseStatusException(HttpStatus.CONFLICT, "Amenity already exists")
         }
+        validateIconKey(request.iconKey)
         val amenity = RoomAmenity(
             name = request.name,
             category = request.category,
@@ -70,6 +76,7 @@ class RoomAmenities(
         if (roomAmenityRepo.existsByNameAndIdNot(request.name, amenityId)) {
             throw ResponseStatusException(HttpStatus.CONFLICT, "Amenity already exists")
         }
+        validateIconKey(request.iconKey)
 
         amenity.name = request.name
         amenity.category = request.category ?: amenity.category
@@ -111,6 +118,14 @@ class RoomAmenities(
             throw ResponseStatusException(HttpStatus.FORBIDDEN, "Super admin only")
         }
     }
+
+    private fun validateIconKey(iconKey: String?) {
+        if (iconKey.isNullOrBlank()) return
+        val file = Paths.get(pngRoot, "${iconKey}.png")
+        if (!Files.exists(file)) {
+            throw ResponseStatusException(HttpStatus.BAD_REQUEST, "Icon key not found")
+        }
+    }
 }
 
 private fun RoomAmenity.toResponse(): AmenityResponse {