Safer File Attachments: Content Type + Size Validation

                  class Profile < ApplicationRecord
  has_one_attached :avatar

  validate :avatar_type_and_size

  private

  def avatar_type_and_size
    return unless avatar.attached?

    if avatar.byte_size > 2.megabytes
      errors.add(:avatar, 'must be smaller than 2MB')
    end

    allowed = %w[image/png image/jpeg image/webp]
    errors.add(:avatar, 'must be an image') unless allowed.include?(avatar.content_type)
  end
end