fix: make media provenance explicit

apps/api/app/media_catalog.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import json
 import os
 from pathlib import Path
+from urllib.parse import urlsplit
 
 
 MEDIA_ROOT = Path(os.environ.get("MEDIA_ROOT", "data/media")).resolve()
@@ -12,6 +13,22 @@ KNOWN_MEDIA_ROLES = WATERBODY_MEDIA_ROLES | TACKLE_MEDIA_ROLES
 MEDIA_ROLES_BY_ENTITY = {"waterbody": WATERBODY_MEDIA_ROLES, "tackle": TACKLE_MEDIA_ROLES}
 
 
+def _source_system(source_page: object) -> str:
+    """Map only allowlisted hostnames; never promote an unknown URL to official."""
+    try:
+        parsed = urlsplit(str(source_page or ""))
+    except ValueError:
+        return "unknown"
+    hostname = (parsed.hostname or "").lower().rstrip(".")
+    if hostname == "rf4db.com" or hostname.endswith(".rf4db.com"):
+        return "rf4db"
+    if hostname == "rf4map.ru" or hostname.endswith(".rf4map.ru"):
+        return "rf4map"
+    if hostname == "rf4-stat.ru" or hostname.endswith(".rf4-stat.ru"):
+        return "rf4stat"
+    return "unknown"
+
+
 def media_manifest_version() -> int:
     manifest = json.loads((MEDIA_ROOT / "manifest.json").read_text(encoding="utf-8"))
     return max(1, int(manifest.get("version", 1)))
@@ -42,7 +59,7 @@ def published_assets(entity_type: str | None = None, media_role: str | None = No
         if not _public_role_allowed(item.get("entity_type"), item.get("media_role")):
             continue
         source_page = str(item.get("source_page") or "")
-        source = "rf4db" if "rf4db.com" in source_page else "rf4map" if "rf4map.ru" in source_page else "rf4-official"
+        source = _source_system(source_page)
         result.append({
             "id": item["sha256"],
             "entity_type": item.get("entity_type"),
@@ -117,7 +134,7 @@ def review_assets(
         if len(digest) != 64 or not item.get("local_path"):
             continue
         source_page = str(item.get("source_page") or "")
-        source = "rf4db" if "rf4db.com" in source_page else "rf4map" if "rf4map.ru" in source_page else "rf4-official"
+        source = _source_system(source_page)
         result.append({
             "id": digest,
             "status": item_status,

apps/api/tests/test_media_catalog.py

@@ -18,3 +18,17 @@ def test_public_media_catalog_rejects_unknown_and_cross_entity_roles(tmp_path, m
     rows = media_catalog.published_assets()
 
     assert [row["id"] for row in rows] == ["d" * 64, "a" * 64]
+
+
+def test_media_catalog_does_not_infer_official_source_from_url_substrings(tmp_path, monkeypatch) -> None:
+    manifest = {"assets": [
+        {"status": "approved", "sha256": "e" * 64, "local_path": "asset.webp", "entity_type": "fish", "entity_key": "pike", "source_page": "https://rf4db.com.attacker.test/pike"},
+        {"status": "approved", "sha256": "f" * 64, "local_path": "asset2.webp", "entity_type": "fish", "entity_key": "pike", "source_page": "https://rf4db.com/ru/fish/pike"},
+    ]}
+    (tmp_path / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+    monkeypatch.setattr(media_catalog, "MEDIA_ROOT", tmp_path)
+
+    rows = {row["id"]: row for row in media_catalog.published_assets()}
+
+    assert rows["e" * 64]["source_system"] == "unknown"
+    assert rows["f" * 64]["source_system"] == "rf4db"