fix: filter public media roles by entity

apps/api/app/media_catalog.py

@@ -6,6 +6,21 @@ from pathlib import Path
 
 
 MEDIA_ROOT = Path(os.environ.get("MEDIA_ROOT", "data/media")).resolve()
+WATERBODY_MEDIA_ROLES = {"waterbody_cover", "waterbody_map", "waterbody_depth_map", "waterbody_screenshot"}
+TACKLE_MEDIA_ROLES = {"tackle_card", "tackle_detail", "rig_diagram", "tackle_screenshot"}
+KNOWN_MEDIA_ROLES = WATERBODY_MEDIA_ROLES | TACKLE_MEDIA_ROLES
+
+
+def _public_role_allowed(entity_type: str | None, role: object) -> bool:
+    if role is None:
+        return True
+    if not isinstance(role, str) or role not in KNOWN_MEDIA_ROLES:
+        return False
+    if entity_type == "waterbody":
+        return role in WATERBODY_MEDIA_ROLES
+    if entity_type == "tackle":
+        return role in TACKLE_MEDIA_ROLES
+    return False
 
 
 def published_assets(entity_type: str | None = None) -> list[dict]:
@@ -16,6 +31,8 @@ def published_assets(entity_type: str | None = None) -> list[dict]:
             continue
         if entity_type and item.get("entity_type") != entity_type:
             continue
+        if not _public_role_allowed(item.get("entity_type"), item.get("media_role")):
+            continue
         source_page = str(item.get("source_page") or "")
         source = "rf4db" if "rf4db.com" in source_page else "rf4map" if "rf4map.ru" in source_page else "rf4-official"
         result.append({

apps/api/tests/test_media_catalog.py

@@ -0,0 +1,20 @@
+import json
+
+from app import media_catalog
+
+
+def test_public_media_catalog_rejects_unknown_and_cross_entity_roles(tmp_path, monkeypatch) -> None:
+    manifest = {
+        "assets": [
+            {"status": "approved", "sha256": "a" * 64, "local_path": "water.webp", "entity_type": "waterbody", "entity_key": "kuori", "media_role": "waterbody_map"},
+            {"status": "approved", "sha256": "b" * 64, "local_path": "wrong.webp", "entity_type": "waterbody", "entity_key": "kuori", "media_role": "tackle_card"},
+            {"status": "approved", "sha256": "c" * 64, "local_path": "unknown.webp", "entity_type": "tackle", "entity_key": "spiker", "media_role": "future_role"},
+            {"status": "approved", "sha256": "d" * 64, "local_path": "tackle.webp", "entity_type": "tackle", "entity_key": "spiker", "media_role": "tackle_card"},
+        ],
+    }
+    (tmp_path / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+    monkeypatch.setattr(media_catalog, "MEDIA_ROOT", tmp_path)
+
+    rows = media_catalog.published_assets()
+
+    assert [row["id"] for row in rows] == ["d" * 64, "a" * 64]