From 6a3c6c54dede46c24793dcd0ff462070beb894e1 Mon Sep 17 00:00:00 2001 From: IK Date: Mon, 21 Sep 2026 20:41:35 +0700 Subject: [PATCH] fix: reject incompatible admin media roles --- apps/api/app/media_catalog.py | 1 + apps/api/app/routers/admin.py | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/apps/api/app/media_catalog.py b/apps/api/app/media_catalog.py index 88a416f..0042df1 100644 --- a/apps/api/app/media_catalog.py +++ b/apps/api/app/media_catalog.py @@ -9,6 +9,7 @@ MEDIA_ROOT = Path(os.environ.get("MEDIA_ROOT", "data/media")).resolve() WATERBODY_MEDIA_ROLES = {"waterbody_cover", "waterbody_map", "waterbody_depth_map", "waterbody_screenshot"} TACKLE_MEDIA_ROLES = {"tackle_card", "tackle_detail", "rig_diagram", "tackle_screenshot"} KNOWN_MEDIA_ROLES = WATERBODY_MEDIA_ROLES | TACKLE_MEDIA_ROLES +MEDIA_ROLES_BY_ENTITY = {"waterbody": WATERBODY_MEDIA_ROLES, "tackle": TACKLE_MEDIA_ROLES} def _public_role_allowed(entity_type: str | None, role: object) -> bool: diff --git a/apps/api/app/routers/admin.py b/apps/api/app/routers/admin.py index fe556b5..0e05831 100644 --- a/apps/api/app/routers/admin.py +++ b/apps/api/app/routers/admin.py @@ -17,7 +17,7 @@ from ..dependencies import Db from ..importer import ImportAlreadyRunning, ImportSourceError, import_records from rf4_research.media_assets import publish_quality_upgrades, rollback_quality_upgrade -from ..media_catalog import KNOWN_MEDIA_ROLES, MEDIA_ROOT, review_assets, review_file +from ..media_catalog import KNOWN_MEDIA_ROLES, MEDIA_ROLES_BY_ENTITY, MEDIA_ROOT, review_assets, review_file from ..models import CatchReport, CommunityImportRun, DataSource, ExternalObservation, Fish, ModerationEvent, ModerationStatus, OfficialRecordImport, SourceType, Waterbody from ..public_cache import public_cache from ..schemas import AdminCatchReportOut, AdminMediaDecision, AdminMediaReviewOut, AdminMediaRollback, AdminModerationHistoryOut, AdminSourceStatusOut, CatchReportCreated, ExternalAliasSuggestionOut, ExternalObservationAction, ExternalObservationBulkAction, ExternalObservationBulkDecision, ExternalObservationBulkMapping, ExternalObservationBulkResult, ExternalObservationDecision, ExternalObservationMapping, ExternalObservationOut, ExternalObservationPublished, ImportRunOut, ModerationBulkResult, ModerationBulkUpdate, ModerationUpdate @@ -43,6 +43,8 @@ def admin_media_catalog( ) -> list[AdminMediaReviewOut]: if media_role and media_role not in KNOWN_MEDIA_ROLES: raise HTTPException(status_code=422, detail="unknown media role") + if media_role and (not entity_type or media_role not in MEDIA_ROLES_BY_ENTITY.get(entity_type, set())): + raise HTTPException(status_code=422, detail="media role is incompatible with entity type") return review_assets(entity_type, status, media_role)[offset:offset + limit]