From 77326a91ca76be036d62e104ad05a4e0d2c1c7b6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 27 Nov 2025 17:44:21 +0000
Subject: [PATCH] Apply critical bug fixes from main to prevent merge
 regressions

This commit applies essential bug fixes from main branch to ensure no
regressions occur when merging the video-support branch:

1. Increase body parser limits from 100mb to 10gb for large video uploads
   - Updated express.json and express.urlencoded limits in server.js

2. Rename video migration from 047 to 048 to avoid conflict
   - Main branch already has 047_add_tls_reject_unauthorized.js
   - Prevents migration system from skipping one of the migrations

3. Fix category update logic with proper validation
   - Add updated_at timestamp to all category updates
   - Add explicit null handling for category_id
   - Add parseInt with radix parameter for numeric IDs
   - Add isNaN validation to prevent invalid values
   - Fix event_id constraint in single photo update query
   - Add parseInt to photoCount comparison for type safety

These fixes ensure all bug fixes from main branch (especially from
commit d91ab43) are preserved when the PR is merged.
---
 ...eo_support.js => 048_add_video_support.js} |  0
 backend/server.js                             |  6 ++--
 backend/src/routes/adminPhotos.js             | 33 +++++++++++++++----
 3 files changed, 29 insertions(+), 10 deletions(-)
 rename backend/migrations/core/{047_add_video_support.js => 048_add_video_support.js} (100%)

diff --git a/backend/migrations/core/047_add_video_support.js b/backend/migrations/core/048_add_video_support.js
similarity index 100%
rename from backend/migrations/core/047_add_video_support.js
rename to backend/migrations/core/048_add_video_support.js
diff --git a/backend/server.js b/backend/server.js
index cdc345c..fa6d133 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -324,9 +324,9 @@ async function initializeRateLimiters() {
 
 // Note: Rate limiters will be initialized after database connection
 
-// Body parsing middleware with increased limits for large batch uploads
-app.use(express.json({ limit: '500mb' }));
-app.use(express.urlencoded({ extended: true, limit: '500mb' }));
+<<<<<<< HEAD
+app.use(express.json({ limit: '10gb' }));
+app.use(express.urlencoded({ extended: true, limit: '10gb' }));
 
 // Request logging for API routes (with timestamps)
 const apiRequestLogger = (req, res, next) => {
diff --git a/backend/src/routes/adminPhotos.js b/backend/src/routes/adminPhotos.js
index 769e27f..84a8320 100644
--- a/backend/src/routes/adminPhotos.js
+++ b/backend/src/routes/adminPhotos.js
@@ -499,14 +499,22 @@ router.patch('/:eventId/photos/:photoId', adminAuth, async (req, res) => {
     if (category_id === 'individual' || category_id === 'collage') {
       updateData.type = category_id;
       updateData.category_id = null; // Clear legacy category_id
+    } else if (category_id === null || category_id === undefined) {
+      // Explicitly clear category
+      updateData.category_id = null;
     } else {
-      // Handle legacy numeric category IDs
-      updateData.category_id = category_id || null;
+      // Handle numeric category IDs from photo_categories table
+      const numericCategoryId = parseInt(category_id, 10);
+      if (!isNaN(numericCategoryId)) {
+        updateData.category_id = numericCategoryId;
+      } else {
+        updateData.category_id = null;
+      }
     }
 
     // Update photo
     await db('photos')
-      .where({ id: photoId })
+      .where({ id: photoId, event_id: eventId })
       .update(updateData);
 
     res.json({ message: 'Photo updated successfully' });
@@ -601,21 +609,32 @@ router.post('/:eventId/photos/bulk-update', adminAuth, async (req, res) => {
       .count('id as count')
       .first();
     
-    if (photoCount.count !== photoIds.length) {
+    if (parseInt(photoCount.count) !== photoIds.length) {
       return res.status(400).json({ error: 'Some photos do not belong to this event' });
     }
     
     // Prepare update data
-    const updateData = {};
+    const updateData = {
+      updated_at: new Date()
+    };
+
     if (updates.category_id !== undefined) {
       // Handle type-based categories ('individual' or 'collage')
       // These are string values that map to the photo.type field
       if (updates.category_id === 'individual' || updates.category_id === 'collage') {
         updateData.type = updates.category_id;
         updateData.category_id = null; // Clear legacy category_id
+      } else if (updates.category_id === null) {
+        // Explicitly clear category
+        updateData.category_id = null;
       } else {
-        // Handle legacy numeric category IDs
-        updateData.category_id = updates.category_id || null;
+        // Handle numeric category IDs from photo_categories table
+        const numericCategoryId = parseInt(updates.category_id, 10);
+        if (!isNaN(numericCategoryId)) {
+          updateData.category_id = numericCategoryId;
+        } else {
+          updateData.category_id = null;
+        }
       }
     }