Files
breedr/server/routes/dogs.js
T
Jason Stedwell 5e45031789 Harden dog endpoints: parent validation, 404s, safe photo handling, transactions
- safeParsePhotos(): corrupted photo_urls JSON no longer crashes every request
  that loads the dog
- DELETE /photos/:idx rejects NaN/out-of-range indexes with 400 (was silent no-op)
- PUT /:id returns 404 for missing dogs (was silent success)
- POST/PUT validate sire/dam exist, have the right sex, and aren't the dog itself
- Dog create (dog+parents), update (dog+parent swap), and cascade delete now run
  in transactions — no more partial writes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-06 14:47:41 -05:00

413 lines
16 KiB
JavaScript

const express = require('express');
const router = express.Router();
const { getDatabase } = require('../db/init');
const multer = require('multer');
const path = require('path');
const fs = require('fs');
const storage = multer.diskStorage({
destination: (req, file, cb) => {
const uploadPath = process.env.UPLOAD_PATH || path.join(__dirname, '../../uploads');
cb(null, uploadPath);
},
filename: (req, file, cb) => {
const uniqueName = `${Date.now()}-${Math.random().toString(36).substring(7)}${path.extname(file.originalname)}`;
cb(null, uniqueName);
}
});
const upload = multer({
storage,
limits: { fileSize: 10 * 1024 * 1024 },
fileFilter: (req, file, cb) => {
const allowed = /jpeg|jpg|png|gif|webp/;
if (allowed.test(path.extname(file.originalname).toLowerCase()) && allowed.test(file.mimetype)) {
cb(null, true);
} else {
cb(new Error('Only image files are allowed'));
}
}
});
const emptyToNull = (v) => (v === '' || v === undefined) ? null : v;
// photo_urls is stored as a JSON array string; never let one corrupted row
// crash every request that loads the dog.
function safeParsePhotos(raw) {
if (!raw) return [];
try {
const parsed = JSON.parse(raw);
return Array.isArray(parsed) ? parsed : [];
} catch (_) {
return [];
}
}
// Sire/dam references must exist and have the right sex — bad parent links
// corrupt the pedigree graph and COI math. Returns an error string or null.
function validateParents(db, sire_id, dam_id, dogId = null) {
const checks = [[sire_id, 'male', 'Sire'], [dam_id, 'female', 'Dam']];
for (const [pid, wantSex, label] of checks) {
if (!pid || pid === '') continue;
if (dogId !== null && String(pid) === String(dogId)) return `${label} cannot be the dog itself`;
const parent = db.prepare('SELECT sex FROM dogs WHERE id = ?').get(pid);
if (!parent) return `${label} does not exist (id ${pid})`;
if (parent.sex !== wantSex) return `${label} must be a ${wantSex} dog`;
}
return null;
}
// ── Shared SELECT columns ────────────────────────────────────────────────
const DOG_COLS = `
id, name, registration_number, breed, sex, birth_date,
color, microchip, photo_urls, notes, litter_id, is_active,
is_champion, is_external, created_at, updated_at
`;
// ── Helper: attach parents to a list of dogs ─────────────────────────────
function attachParents(db, dogs) {
const parentStmt = db.prepare(`
SELECT p.parent_type, d.id, d.name, d.is_champion, d.is_external
FROM parents p
JOIN dogs d ON p.parent_id = d.id
WHERE p.dog_id = ?
`);
dogs.forEach(dog => {
dog.photo_urls = safeParsePhotos(dog.photo_urls);
const parents = parentStmt.all(dog.id);
dog.sire = parents.find(p => p.parent_type === 'sire') || null;
dog.dam = parents.find(p => p.parent_type === 'dam') || null;
});
return dogs;
}
// ── GET dogs (paginated)
// Default: kennel dogs only (is_external = 0)
// ?include_external=1 : all active dogs (kennel + external)
// ?external_only=1 : external dogs only
// ?page=1&limit=50 : pagination
// ?search=term : filter by name or registration_number
// ?sex=male|female : filter by sex
// Response: { data, total, page, limit, stats: { total, males, females } }
// ─────────────────────────────────────────────────────────────────────────
router.get('/', (req, res) => {
try {
const db = getDatabase();
const includeExternal = req.query.include_external === '1' || req.query.include_external === 'true';
const externalOnly = req.query.external_only === '1' || req.query.external_only === 'true';
const search = (req.query.search || '').trim();
const sex = req.query.sex === 'male' || req.query.sex === 'female' ? req.query.sex : '';
const page = Math.max(1, parseInt(req.query.page, 10) || 1);
const limit = Math.min(200, Math.max(1, parseInt(req.query.limit, 10) || 50));
const offset = (page - 1) * limit;
let baseWhere;
if (externalOnly) {
baseWhere = 'is_active = 1 AND is_external = 1';
} else if (includeExternal) {
baseWhere = 'is_active = 1';
} else {
baseWhere = 'is_active = 1 AND is_external = 0';
}
const filters = [];
const params = [];
if (search) {
filters.push('(name LIKE ? OR registration_number LIKE ?)');
params.push(`%${search}%`, `%${search}%`);
}
if (sex) {
filters.push('sex = ?');
params.push(sex);
}
const whereClause = 'WHERE ' + [baseWhere, ...filters].join(' AND ');
const total = db.prepare(`SELECT COUNT(*) as count FROM dogs ${whereClause}`).get(...params).count;
const statsWhere = externalOnly
? 'WHERE is_active = 1 AND is_external = 1'
: includeExternal
? 'WHERE is_active = 1'
: 'WHERE is_active = 1 AND is_external = 0';
const stats = db.prepare(`
SELECT
COUNT(*) as total,
SUM(CASE WHEN sex = 'male' THEN 1 ELSE 0 END) as males,
SUM(CASE WHEN sex = 'female' THEN 1 ELSE 0 END) as females
FROM dogs ${statsWhere}
`).get();
const dogs = db.prepare(`
SELECT ${DOG_COLS}
FROM dogs
${whereClause}
ORDER BY name
LIMIT ? OFFSET ?
`).all(...params, limit, offset);
res.json({ data: attachParents(db, dogs), total, page, limit, stats });
} catch (error) {
console.error('Error fetching dogs:', error);
res.status(500).json({ error: error.message });
}
});
// ── GET all dogs (kennel + external) for dropdowns/pairing/pedigree ──────────
// Kept for backwards-compat; equivalent to GET /?include_external=1
router.get('/all', (req, res) => {
try {
const db = getDatabase();
const dogs = db.prepare(`
SELECT ${DOG_COLS}
FROM dogs
WHERE is_active = 1
ORDER BY name
`).all();
res.json(attachParents(db, dogs));
} catch (error) {
console.error('Error fetching all dogs:', error);
res.status(500).json({ error: error.message });
}
});
// ── GET external dogs only (is_external = 1) ──────────────────────────────
// Kept for backwards-compat; equivalent to GET /?external_only=1
router.get('/external', (req, res) => {
try {
const db = getDatabase();
const dogs = db.prepare(`
SELECT ${DOG_COLS}
FROM dogs
WHERE is_active = 1 AND is_external = 1
ORDER BY name
`).all();
res.json(attachParents(db, dogs));
} catch (error) {
console.error('Error fetching external dogs:', error);
res.status(500).json({ error: error.message });
}
});
// ── GET single dog (with parents + offspring) ──────────────────────────
router.get('/:id', (req, res) => {
try {
const db = getDatabase();
const dog = db.prepare(`SELECT ${DOG_COLS} FROM dogs WHERE id = ?`).get(req.params.id);
if (!dog) return res.status(404).json({ error: 'Dog not found' });
dog.photo_urls = safeParsePhotos(dog.photo_urls);
const parents = db.prepare(`
SELECT p.parent_type, d.id, d.name, d.is_champion, d.is_external
FROM parents p
JOIN dogs d ON p.parent_id = d.id
WHERE p.dog_id = ?
`).all(req.params.id);
dog.sire = parents.find(p => p.parent_type === 'sire') || null;
dog.dam = parents.find(p => p.parent_type === 'dam') || null;
dog.offspring = db.prepare(`
SELECT d.id, d.name, d.sex, d.is_champion, d.is_external
FROM dogs d
JOIN parents p ON d.id = p.dog_id
WHERE p.parent_id = ? AND d.is_active = 1
`).all(req.params.id);
res.json(dog);
} catch (error) {
console.error('Error fetching dog:', error);
res.status(500).json({ error: error.message });
}
});
// ── POST create dog ─────────────────────────────────────────────────────
router.post('/', (req, res) => {
try {
const { name, registration_number, breed, sex, birth_date, color,
microchip, notes, sire_id, dam_id, litter_id, is_champion, is_external } = req.body;
if (!name || !breed || !sex) {
return res.status(400).json({ error: 'Name, breed, and sex are required' });
}
const db = getDatabase();
const parentError = validateParents(db, sire_id, dam_id);
if (parentError) return res.status(400).json({ error: parentError });
const createDog = db.transaction(() => {
const result = db.prepare(`
INSERT INTO dogs (name, registration_number, breed, sex, birth_date, color,
microchip, notes, litter_id, photo_urls, is_champion, is_external)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
`).run(
name,
emptyToNull(registration_number),
breed, sex,
emptyToNull(birth_date),
emptyToNull(color),
emptyToNull(microchip),
emptyToNull(notes),
emptyToNull(litter_id),
'[]',
is_champion ? 1 : 0,
is_external ? 1 : 0
);
const id = result.lastInsertRowid;
if (sire_id && sire_id !== '' && sire_id !== null) {
db.prepare('INSERT INTO parents (dog_id, parent_id, parent_type) VALUES (?, ?, ?)').run(id, sire_id, 'sire');
}
if (dam_id && dam_id !== '' && dam_id !== null) {
db.prepare('INSERT INTO parents (dog_id, parent_id, parent_type) VALUES (?, ?, ?)').run(id, dam_id, 'dam');
}
return id;
});
const dogId = createDog();
const dog = db.prepare(`SELECT ${DOG_COLS} FROM dogs WHERE id = ?`).get(dogId);
dog.photo_urls = [];
console.log(`✔ Dog created: ${dog.name} (ID: ${dogId}, external: ${dog.is_external})`);
res.status(201).json(dog);
} catch (error) {
console.error('Error creating dog:', error);
res.status(500).json({ error: error.message });
}
});
// ── PUT update dog ───────────────────────────────────────────────────────
router.put('/:id', (req, res) => {
try {
const { name, registration_number, breed, sex, birth_date, color,
microchip, notes, sire_id, dam_id, litter_id, is_champion, is_external } = req.body;
const db = getDatabase();
const existing = db.prepare('SELECT id FROM dogs WHERE id = ?').get(req.params.id);
if (!existing) return res.status(404).json({ error: 'Dog not found' });
const parentError = validateParents(db, sire_id, dam_id, req.params.id);
if (parentError) return res.status(400).json({ error: parentError });
const updateDog = db.transaction(() => {
db.prepare(`
UPDATE dogs
SET name = ?, registration_number = ?, breed = ?, sex = ?,
birth_date = ?, color = ?, microchip = ?, notes = ?,
litter_id = ?, is_champion = ?, is_external = ?, updated_at = datetime('now')
WHERE id = ?
`).run(
name,
emptyToNull(registration_number),
breed, sex,
emptyToNull(birth_date),
emptyToNull(color),
emptyToNull(microchip),
emptyToNull(notes),
emptyToNull(litter_id),
is_champion ? 1 : 0,
is_external ? 1 : 0,
req.params.id
);
db.prepare('DELETE FROM parents WHERE dog_id = ?').run(req.params.id);
if (sire_id && sire_id !== '' && sire_id !== null) {
db.prepare('INSERT INTO parents (dog_id, parent_id, parent_type) VALUES (?, ?, ?)').run(req.params.id, sire_id, 'sire');
}
if (dam_id && dam_id !== '' && dam_id !== null) {
db.prepare('INSERT INTO parents (dog_id, parent_id, parent_type) VALUES (?, ?, ?)').run(req.params.id, dam_id, 'dam');
}
});
updateDog();
const dog = db.prepare(`SELECT ${DOG_COLS} FROM dogs WHERE id = ?`).get(req.params.id);
dog.photo_urls = safeParsePhotos(dog.photo_urls);
console.log(`✔ Dog updated: ${dog.name} (ID: ${req.params.id})`);
res.json(dog);
} catch (error) {
console.error('Error updating dog:', error);
res.status(500).json({ error: error.message });
}
});
// ── DELETE dog (hard delete with cascade) ───────────────────────────────
router.delete('/:id', (req, res) => {
try {
const db = getDatabase();
const existing = db.prepare('SELECT id, name FROM dogs WHERE id = ?').get(req.params.id);
if (!existing) return res.status(404).json({ error: 'Dog not found' });
const id = req.params.id;
db.transaction(() => {
db.prepare('DELETE FROM parents WHERE parent_id = ?').run(id);
db.prepare('DELETE FROM parents WHERE dog_id = ?').run(id);
db.prepare('DELETE FROM health_records WHERE dog_id = ?').run(id);
db.prepare('DELETE FROM heat_cycles WHERE dog_id = ?').run(id);
db.prepare('DELETE FROM dogs WHERE id = ?').run(id);
})();
console.log(`✔ Dog #${id} (${existing.name}) permanently deleted`);
res.json({ success: true, message: `${existing.name} has been deleted` });
} catch (error) {
console.error('Error deleting dog:', error);
res.status(500).json({ error: error.message });
}
});
// ── POST upload photo ────────────────────────────────────────────────────
router.post('/:id/photos', upload.single('photo'), (req, res) => {
try {
if (!req.file) return res.status(400).json({ error: 'No file uploaded' });
const db = getDatabase();
const dog = db.prepare('SELECT photo_urls FROM dogs WHERE id = ?').get(req.params.id);
if (!dog) return res.status(404).json({ error: 'Dog not found' });
const photoUrls = safeParsePhotos(dog.photo_urls);
photoUrls.push(`/uploads/${req.file.filename}`);
db.prepare('UPDATE dogs SET photo_urls = ? WHERE id = ?').run(JSON.stringify(photoUrls), req.params.id);
res.json({ url: `/uploads/${req.file.filename}`, photos: photoUrls });
} catch (error) {
console.error('Error uploading photo:', error);
res.status(500).json({ error: error.message });
}
});
// ── DELETE photo ──────────────────────────────────────────────────────
router.delete('/:id/photos/:photoIndex', (req, res) => {
try {
const db = getDatabase();
const dog = db.prepare('SELECT photo_urls FROM dogs WHERE id = ?').get(req.params.id);
if (!dog) return res.status(404).json({ error: 'Dog not found' });
const photoUrls = safeParsePhotos(dog.photo_urls);
const photoIndex = parseInt(req.params.photoIndex, 10);
if (!Number.isInteger(photoIndex) || photoIndex < 0 || photoIndex >= photoUrls.length) {
return res.status(400).json({ error: 'Invalid photo index' });
}
const photoPath = path.join(
process.env.UPLOAD_PATH || path.join(__dirname, '../../uploads'),
path.basename(photoUrls[photoIndex])
);
if (fs.existsSync(photoPath)) fs.unlinkSync(photoPath);
photoUrls.splice(photoIndex, 1);
db.prepare('UPDATE dogs SET photo_urls = ? WHERE id = ?').run(JSON.stringify(photoUrls), req.params.id);
res.json({ photos: photoUrls });
} catch (error) {
console.error('Error deleting photo:', error);
res.status(500).json({ error: error.message });
}
});
module.exports = router;