fix: reject incompatible admin media roles

apps/api/app/media_catalog.py

@@ -9,6 +9,7 @@ MEDIA_ROOT = Path(os.environ.get("MEDIA_ROOT", "data/media")).resolve()
 WATERBODY_MEDIA_ROLES = {"waterbody_cover", "waterbody_map", "waterbody_depth_map", "waterbody_screenshot"}
 TACKLE_MEDIA_ROLES = {"tackle_card", "tackle_detail", "rig_diagram", "tackle_screenshot"}
 KNOWN_MEDIA_ROLES = WATERBODY_MEDIA_ROLES | TACKLE_MEDIA_ROLES
+MEDIA_ROLES_BY_ENTITY = {"waterbody": WATERBODY_MEDIA_ROLES, "tackle": TACKLE_MEDIA_ROLES}
 
 
 def _public_role_allowed(entity_type: str | None, role: object) -> bool:

apps/api/app/routers/admin.py

@@ -17,7 +17,7 @@ from ..dependencies import Db
 from ..importer import ImportAlreadyRunning, ImportSourceError, import_records
 from rf4_research.media_assets import publish_quality_upgrades, rollback_quality_upgrade
 
-from ..media_catalog import KNOWN_MEDIA_ROLES, MEDIA_ROOT, review_assets, review_file
+from ..media_catalog import KNOWN_MEDIA_ROLES, MEDIA_ROLES_BY_ENTITY, MEDIA_ROOT, review_assets, review_file
 from ..models import CatchReport, CommunityImportRun, DataSource, ExternalObservation, Fish, ModerationEvent, ModerationStatus, OfficialRecordImport, SourceType, Waterbody
 from ..public_cache import public_cache
 from ..schemas import AdminCatchReportOut, AdminMediaDecision, AdminMediaReviewOut, AdminMediaRollback, AdminModerationHistoryOut, AdminSourceStatusOut, CatchReportCreated, ExternalAliasSuggestionOut, ExternalObservationAction, ExternalObservationBulkAction, ExternalObservationBulkDecision, ExternalObservationBulkMapping, ExternalObservationBulkResult, ExternalObservationDecision, ExternalObservationMapping, ExternalObservationOut, ExternalObservationPublished, ImportRunOut, ModerationBulkResult, ModerationBulkUpdate, ModerationUpdate
@@ -43,6 +43,8 @@ def admin_media_catalog(
 ) -> list[AdminMediaReviewOut]:
     if media_role and media_role not in KNOWN_MEDIA_ROLES:
         raise HTTPException(status_code=422, detail="unknown media role")
+    if media_role and (not entity_type or media_role not in MEDIA_ROLES_BY_ENTITY.get(entity_type, set())):
+        raise HTTPException(status_code=422, detail="media role is incompatible with entity type")
     return review_assets(entity_type, status, media_role)[offset:offset + limit]