From 57dd084763e33bf45f29eb1cc8fcd365f54c5bd1 Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Tue, 1 Sep 2026 18:51:35 +0200 Subject: [PATCH] fix(events): add archive_size to the immutable column deny-set IMMUTABLE_EVENT_COLUMNS is documented as a COMPLETE deny-set that new server-managed columns must be added to. archive_size is written by archiveService from the zip's real byte count and is what the archives list now sorts and displays, so an events.edit holder could otherwise set a cosmetic size on a non-archived event. Follow-up to 59666b59, which added the column. --- backend/src/routes/adminEvents/crud.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/backend/src/routes/adminEvents/crud.js b/backend/src/routes/adminEvents/crud.js index 5fc011f6..8a6a0691 100644 --- a/backend/src/routes/adminEvents/crud.js +++ b/backend/src/routes/adminEvents/crud.js @@ -1655,6 +1655,9 @@ module.exports = (router) => { // Server-consumed file paths — e.g. DELETE /:id/logo fs.unlink()s // hero_logo_path, so a forged value is an arbitrary-delete primitive. 'hero_logo_path', 'hero_logo_url', 'archive_path', 'download_zip_path', + // Written by archiveService from the zip's real byte count; the + // archives list both sorts and displays it. + 'archive_size', // Server-managed timestamps 'download_zip_generated_at', 'archived_at', 'revealed_at', 'event_reminder_sent_at', // Lifecycle — governed by dedicated permission-gated routes