jason/breedr
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden dog endpoints: parent validation, 404s, safe photo handling, transactions

Browse Source 
- safeParsePhotos(): corrupted photo_urls JSON no longer crashes every request
  that loads the dog
- DELETE /photos/:idx rejects NaN/out-of-range indexes with 400 (was silent no-op)
- PUT /:id returns 404 for missing dogs (was silent success)
- POST/PUT validate sire/dam exist, have the right sex, and aren't the dog itself
- Dog create (dog+parents), update (dog+parent swap), and cascade delete now run
  in transactions — no more partial writes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Jason Stedwell
2026-07-06 14:47:41 -05:00
parent 1f1e0c3e5a
commit 5e45031789
1 changed files with 117 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routes/dogs.js
+60 -12
View File
@@ -31,6 +31,32 @@ const upload = multer({
const emptyToNull = (v) => (v === '' || v === undefined) ? null : v;
// photo_urls is stored as a JSON array string; never let one corrupted row
// crash every request that loads the dog.
function safeParsePhotos(raw) {
if (!raw) return [];
try {
const parsed = JSON.parse(raw);
return Array.isArray(parsed) ? parsed : [];
} catch (_) {
return [];
}
}
// Sire/dam references must exist and have the right sex — bad parent links
// corrupt the pedigree graph and COI math. Returns an error string or null.
function validateParents(db, sire_id, dam_id, dogId = null) {
const checks = [[sire_id, 'male', 'Sire'], [dam_id, 'female', 'Dam']];
for (const [pid, wantSex, label] of checks) {
if (!pid || pid === '') continue;
if (dogId !== null && String(pid) === String(dogId)) return `${label} cannot be the dog itself`;
const parent = db.prepare('SELECT sex FROM dogs WHERE id = ?').get(pid);
if (!parent) return `${label} does not exist (id ${pid})`;
if (parent.sex !== wantSex) return `${label} must be a ${wantSex} dog`;
}
return null;
}
// ── Shared SELECT columns ────────────────────────────────────────────────
const DOG_COLS = `
id, name, registration_number, breed, sex, birth_date,
@@ -47,7 +73,7 @@ function attachParents(db, dogs) {
WHERE p.dog_id = ?
`);
dogs.forEach(dog => {
dog.photo_urls = dog.photo_urls ? JSON.parse(dog.photo_urls) : [];
dog.photo_urls = safeParsePhotos(dog.photo_urls);
const parents = parentStmt.all(dog.id);
dog.sire = parents.find(p => p.parent_type === 'sire') || null;
dog.dam = parents.find(p => p.parent_type === 'dam') || null;
@@ -171,7 +197,7 @@ router.get('/:id', (req, res) => {
if (!dog) return res.status(404).json({ error: 'Dog not found' });
dog.photo_urls = dog.photo_urls ? JSON.parse(dog.photo_urls) : [];
dog.photo_urls = safeParsePhotos(dog.photo_urls);
const parents = db.prepare(`
SELECT p.parent_type, d.id, d.name, d.is_champion, d.is_external
@@ -208,6 +234,11 @@ router.post('/', (req, res) => {
}
const db = getDatabase();
const parentError = validateParents(db, sire_id, dam_id);
if (parentError) return res.status(400).json({ error: parentError });
const createDog = db.transaction(() => {
const result = db.prepare(`
INSERT INTO dogs (name, registration_number, breed, sex, birth_date, color,
microchip, notes, litter_id, photo_urls, is_champion, is_external)
@@ -226,14 +257,17 @@ router.post('/', (req, res) => {
is_external ? 1 : 0
);
const dogId = result.lastInsertRowid;
const id = result.lastInsertRowid;
if (sire_id && sire_id !== '' && sire_id !== null) {
db.prepare('INSERT INTO parents (dog_id, parent_id, parent_type) VALUES (?, ?, ?)').run(dogId, sire_id, 'sire');
db.prepare('INSERT INTO parents (dog_id, parent_id, parent_type) VALUES (?, ?, ?)').run(id, sire_id, 'sire');
}
if (dam_id && dam_id !== '' && dam_id !== null) {
db.prepare('INSERT INTO parents (dog_id, parent_id, parent_type) VALUES (?, ?, ?)').run(dogId, dam_id, 'dam');
db.prepare('INSERT INTO parents (dog_id, parent_id, parent_type) VALUES (?, ?, ?)').run(id, dam_id, 'dam');
}
return id;
});
const dogId = createDog();
const dog = db.prepare(`SELECT ${DOG_COLS} FROM dogs WHERE id = ?`).get(dogId);
dog.photo_urls = [];
@@ -253,6 +287,14 @@ router.put('/:id', (req, res) => {
microchip, notes, sire_id, dam_id, litter_id, is_champion, is_external } = req.body;
const db = getDatabase();
const existing = db.prepare('SELECT id FROM dogs WHERE id = ?').get(req.params.id);
if (!existing) return res.status(404).json({ error: 'Dog not found' });
const parentError = validateParents(db, sire_id, dam_id, req.params.id);
if (parentError) return res.status(400).json({ error: parentError });
const updateDog = db.transaction(() => {
db.prepare(`
UPDATE dogs
SET name = ?, registration_number = ?, breed = ?, sex = ?,
@@ -280,9 +322,11 @@ router.put('/:id', (req, res) => {
if (dam_id && dam_id !== '' && dam_id !== null) {
db.prepare('INSERT INTO parents (dog_id, parent_id, parent_type) VALUES (?, ?, ?)').run(req.params.id, dam_id, 'dam');
}
});
updateDog();
const dog = db.prepare(`SELECT ${DOG_COLS} FROM dogs WHERE id = ?`).get(req.params.id);
dog.photo_urls = dog.photo_urls ? JSON.parse(dog.photo_urls) : [];
dog.photo_urls = safeParsePhotos(dog.photo_urls);
console.log(`✔ Dog updated: ${dog.name} (ID: ${req.params.id})`);
res.json(dog);
@@ -300,11 +344,13 @@ router.delete('/:id', (req, res) => {
if (!existing) return res.status(404).json({ error: 'Dog not found' });
const id = req.params.id;
db.transaction(() => {
db.prepare('DELETE FROM parents WHERE parent_id = ?').run(id);
db.prepare('DELETE FROM parents WHERE dog_id = ?').run(id);
db.prepare('DELETE FROM health_records WHERE dog_id = ?').run(id);
db.prepare('DELETE FROM heat_cycles WHERE dog_id = ?').run(id);
db.prepare('DELETE FROM dogs WHERE id = ?').run(id);
})();
console.log(`✔ Dog #${id} (${existing.name}) permanently deleted`);
res.json({ success: true, message: `${existing.name} has been deleted` });
@@ -323,7 +369,7 @@ router.post('/:id/photos', upload.single('photo'), (req, res) => {
const dog = db.prepare('SELECT photo_urls FROM dogs WHERE id = ?').get(req.params.id);
if (!dog) return res.status(404).json({ error: 'Dog not found' });
const photoUrls = dog.photo_urls ? JSON.parse(dog.photo_urls) : [];
const photoUrls = safeParsePhotos(dog.photo_urls);
photoUrls.push(`/uploads/${req.file.filename}`);
db.prepare('UPDATE dogs SET photo_urls = ? WHERE id = ?').run(JSON.stringify(photoUrls), req.params.id);
@@ -341,10 +387,13 @@ router.delete('/:id/photos/:photoIndex', (req, res) => {
const dog = db.prepare('SELECT photo_urls FROM dogs WHERE id = ?').get(req.params.id);
if (!dog) return res.status(404).json({ error: 'Dog not found' });
const photoUrls = dog.photo_urls ? JSON.parse(dog.photo_urls) : [];
const photoIndex = parseInt(req.params.photoIndex);
const photoUrls = safeParsePhotos(dog.photo_urls);
const photoIndex = parseInt(req.params.photoIndex, 10);
if (!Number.isInteger(photoIndex) || photoIndex < 0 || photoIndex >= photoUrls.length) {
return res.status(400).json({ error: 'Invalid photo index' });
}
if (photoIndex >= 0 && photoIndex < photoUrls.length) {
const photoPath = path.join(
process.env.UPLOAD_PATH || path.join(__dirname, '../../uploads'),
path.basename(photoUrls[photoIndex])
@@ -352,7 +401,6 @@ router.delete('/:id/photos/:photoIndex', (req, res) => {
if (fs.existsSync(photoPath)) fs.unlinkSync(photoPath);
photoUrls.splice(photoIndex, 1);
db.prepare('UPDATE dogs SET photo_urls = ? WHERE id = ?').run(JSON.stringify(photoUrls), req.params.id);
}
res.json({ photos: photoUrls });
} catch (error) {