@de-otio/trellis 0.4.0

package/dist/lib/routes/link-reports.js

@@ -0,0 +1,287 @@
+"use strict";
+/**
+ * Link Report Routes
+ *
+ * Handles user reports of malicious or suspicious links.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.linkReportRoutes = void 0;
+const data_router_1 = require("../data-router");
+const domain_reputation_service_1 = require("../domain-reputation-service");
+const email_provider_1 = require("../email-provider");
+const logger_1 = require("../logger");
+const middleware_1 = require("../middleware");
+const rate_limit_1 = require("../rate-limit");
+const secret_resolver_1 = require("../secret-resolver");
+const security_headers_1 = require("../security-headers");
+const session_manager_1 = require("../session-manager");
+const validation_1 = require("../validation");
+exports.linkReportRoutes = [
+    {
+        path: /^\/api\/posts\/([^/]+)\/links\/([^/]+)\/report$/,
+        method: "POST",
+        handler: async (request, env, { pathname, requestContext }) => {
+            const sessionManager = new session_manager_1.SessionManager();
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = logger_1.Logger.getInstance(env);
+            const rateLimiter = new rate_limit_1.RateLimiter();
+            const validator = new validation_1.Validator();
+            // Check authentication
+            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            if (!session) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+            }
+            // Apply rate limiting: 10 reports per hour per user
+            const rateLimitResponse = await rateLimiter.applyRateLimitKV(env, request, "/link-reports", 10, 3600, session.userId);
+            if (rateLimitResponse) {
+                return securityHeaders.addSecurityHeaders(rateLimitResponse);
+            }
+            try {
+                if (!requestContext) {
+                    return securityHeaders.createSecureResponse(JSON.stringify({ error: "Request context not available" }), { status: 500, headers: { "content-type": "application/json" } });
+                }
+                // Extract postId and linkId from path
+                const match = pathname.match(/^\/api\/posts\/([^/]+)\/links\/([^/]+)\/report$/);
+                if (!match) {
+                    return securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid URL format" }), { status: 400, headers: { "content-type": "application/json" } });
+                }
+                const postId = match[1];
+                const linkId = match[2];
+                // Parse request body
+                const body = (await request.json().catch(() => ({})));
+                // Get region from request context
+                const region = requestContext.region || env.DEFAULT_REGION || "EU";
+                const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+                // Get link check to find the URL and domain
+                const linkCheck = await db.linkCheck.findUnique({
+                    where: { id: linkId },
+                    include: {
+                        post: {
+                            where: { id: postId },
+                        },
+                    },
+                });
+                if (!linkCheck || linkCheck.postId !== postId) {
+                    return securityHeaders.createSecureResponse(JSON.stringify({ error: "Link not found" }), { status: 404, headers: { "content-type": "application/json" } });
+                }
+                // Extract domain from URL
+                let domain = "";
+                try {
+                    const url = new URL(linkCheck.normalizedUrl || linkCheck.originalUrl);
+                    domain = url.hostname.toLowerCase();
+                    // Remove www. prefix
+                    if (domain.startsWith("www.")) {
+                        domain = domain.substring(4);
+                    }
+                }
+                catch (e) {
+                    logger.warn(`[LinkReports] Failed to parse URL: ${linkCheck.originalUrl}`);
+                    return securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid link URL" }), { status: 400, headers: { "content-type": "application/json" } });
+                }
+                // Create link report
+                const report = await db.linkReport.create({
+                    data: {
+                        userId: session.userId,
+                        linkUrl: linkCheck.normalizedUrl || linkCheck.originalUrl,
+                        domain,
+                        reason: body.reason || null,
+                        status: "pending",
+                    },
+                });
+                // Update domain reputation (negative signal)
+                const reputationService = new domain_reputation_service_1.DomainReputationService(env);
+                await reputationService.updateReputation(domain, "user_report", region, env);
+                // Check if domain should be auto-blocked
+                const shouldAutoBlock = await reputationService.shouldAutoBlock(domain, region, env);
+                if (shouldAutoBlock) {
+                    await reputationService.updateReputation(domain, "auto_block", region, env);
+                    logger.info(`[LinkReports] Auto-blocked domain ${domain} due to report threshold`);
+                    // Notify moderators about auto-block
+                    await notifyModeratorsOfAutoBlock(domain, report.id, env, logger);
+                }
+                // Log the report
+                logger.info(`[LinkReports] User ${session.userId} reported link ${linkId} in post ${postId} (domain: ${domain})`);
+                return securityHeaders.createSecureResponse(JSON.stringify({
+                    success: true,
+                    report: {
+                        id: report.id,
+                        status: report.status,
+                        createdAt: report.createdAt.toISOString(),
+                    },
+                }), { status: 201, headers: { "content-type": "application/json" } });
+            }
+            catch (error) {
+                logger.error("[LinkReports] Error creating report:", error);
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: validator.sanitizeError(error) }), { status: 500, headers: { "content-type": "application/json" } });
+            }
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Report a link in a post",
+    },
+    {
+        path: /^\/api\/comments\/([^/]+)\/links\/([^/]+)\/report$/,
+        method: "POST",
+        handler: async (request, env, { pathname, requestContext }) => {
+            const sessionManager = new session_manager_1.SessionManager();
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = logger_1.Logger.getInstance(env);
+            const rateLimiter = new rate_limit_1.RateLimiter();
+            const validator = new validation_1.Validator();
+            // Check authentication
+            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            if (!session) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+            }
+            // Apply rate limiting: 10 reports per hour per user
+            const rateLimitResponse = await rateLimiter.applyRateLimitKV(env, request, "/link-reports", 10, 3600, session.userId);
+            if (rateLimitResponse) {
+                return securityHeaders.addSecurityHeaders(rateLimitResponse);
+            }
+            try {
+                if (!requestContext) {
+                    return securityHeaders.createSecureResponse(JSON.stringify({ error: "Request context not available" }), { status: 500, headers: { "content-type": "application/json" } });
+                }
+                // Extract commentId and linkId from path
+                const match = pathname.match(/^\/api\/comments\/([^/]+)\/links\/([^/]+)\/report$/);
+                if (!match) {
+                    return securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid URL format" }), { status: 400, headers: { "content-type": "application/json" } });
+                }
+                const commentId = match[1];
+                const linkId = match[2];
+                // Parse request body
+                const body = (await request.json().catch(() => ({})));
+                // Get region from request context
+                const region = requestContext.region || env.DEFAULT_REGION || "EU";
+                const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+                // Get link check to find the URL and domain
+                const linkCheck = await db.linkCheck.findUnique({
+                    where: { id: linkId },
+                    include: {
+                        comment: {
+                            where: { id: commentId },
+                        },
+                    },
+                });
+                if (!linkCheck || linkCheck.commentId !== commentId) {
+                    return securityHeaders.createSecureResponse(JSON.stringify({ error: "Link not found" }), { status: 404, headers: { "content-type": "application/json" } });
+                }
+                // Extract domain from URL
+                let domain = "";
+                try {
+                    const url = new URL(linkCheck.normalizedUrl || linkCheck.originalUrl);
+                    domain = url.hostname.toLowerCase();
+                    // Remove www. prefix
+                    if (domain.startsWith("www.")) {
+                        domain = domain.substring(4);
+                    }
+                }
+                catch (e) {
+                    logger.warn(`[LinkReports] Failed to parse URL: ${linkCheck.originalUrl}`);
+                    return securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid link URL" }), { status: 400, headers: { "content-type": "application/json" } });
+                }
+                // Create link report
+                const report = await db.linkReport.create({
+                    data: {
+                        userId: session.userId,
+                        linkUrl: linkCheck.normalizedUrl || linkCheck.originalUrl,
+                        domain,
+                        reason: body.reason || null,
+                        status: "pending",
+                    },
+                });
+                // Update domain reputation (negative signal)
+                const reputationService = new domain_reputation_service_1.DomainReputationService(env);
+                await reputationService.updateReputation(domain, "user_report", region, env);
+                // Check if domain should be auto-blocked
+                const shouldAutoBlock = await reputationService.shouldAutoBlock(domain, region, env);
+                if (shouldAutoBlock) {
+                    await reputationService.updateReputation(domain, "auto_block", region, env);
+                    logger.info(`[LinkReports] Auto-blocked domain ${domain} due to report threshold`);
+                    // Notify moderators about auto-block
+                    await notifyModeratorsOfAutoBlock(domain, report.id, env, logger);
+                }
+                // Log the report
+                logger.info(`[LinkReports] User ${session.userId} reported link ${linkId} in comment ${commentId} (domain: ${domain})`);
+                return securityHeaders.createSecureResponse(JSON.stringify({
+                    success: true,
+                    report: {
+                        id: report.id,
+                        status: report.status,
+                        createdAt: report.createdAt.toISOString(),
+                    },
+                }), { status: 201, headers: { "content-type": "application/json" } });
+            }
+            catch (error) {
+                logger.error("[LinkReports] Error creating report:", error);
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: validator.sanitizeError(error) }), { status: 500, headers: { "content-type": "application/json" } });
+            }
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Report a link in a comment",
+    },
+];
+/**
+ * Notify moderators when a domain is auto-blocked
+ */
+async function notifyModeratorsOfAutoBlock(domain, reportId, env, logger) {
+    try {
+        // Check if webhook URL is configured
+        if (env.MODERATOR_WEBHOOK_URL) {
+            await fetch(env.MODERATOR_WEBHOOK_URL, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    type: "domain_auto_blocked",
+                    domain,
+                    reportId,
+                    timestamp: new Date().toISOString(),
+                    message: `Domain ${domain} has been automatically blocked due to reaching the report threshold. Review report ${reportId}.`,
+                }),
+            });
+            logger.info(`[LinkReports] Sent auto-block notification to moderators for domain ${domain}`);
+        }
+        else if (env.MODERATOR_EMAILS) {
+            // Fallback to email if webhook not configured
+            const emailProvider = (0, email_provider_1.createEmailProvider)({
+                provider: env.EMAIL_SERVICE || "resend",
+                resendApiKey: env.RESEND_API_KEY,
+                alibabaAccessKeyId: env.ALIBABA_ACCESS_KEY_ID,
+                alibabaAccessKeySecret: env.ALIBABA_ACCESS_KEY_SECRET,
+                alibabaRegion: env.ALIBABA_REGION,
+                alibabaAccountName: env.ALIBABA_ACCOUNT_NAME,
+                tencentSecretId: env.TENCENT_SECRET_ID,
+                tencentSecretKey: env.TENCENT_SECRET_KEY,
+                tencentRegion: env.TENCENT_REGION,
+                tencentFromEmail: env.TENCENT_FROM_EMAIL,
+                awsAccessKeyId: env.AWS_ACCESS_KEY_ID,
+                awsSecretAccessKey: env.AWS_SECRET_ACCESS_KEY,
+                awsRegion: env.AWS_REGION,
+            });
+            const moderatorEmails = Array.isArray(env.MODERATOR_EMAILS)
+                ? env.MODERATOR_EMAILS
+                : env.MODERATOR_EMAILS.split(",").map((e) => e.trim());
+            await emailProvider.sendEmail({
+                from: env.FROM_EMAIL || "noreply@example.com",
+                to: moderatorEmails,
+                subject: `Domain Auto-Blocked: ${domain}`,
+                html: `
+          <h2>Domain Auto-Blocked</h2>
+          <p>The domain <strong>${domain}</strong> has been automatically blocked due to reaching the report threshold.</p>
+          <p><strong>Report ID:</strong> ${reportId}</p>
+          <p><strong>Timestamp:</strong> ${new Date().toISOString()}</p>
+          <p>Please review the report and take appropriate action.</p>
+        `,
+                text: `Domain Auto-Blocked: ${domain}\n\nReport ID: ${reportId}\nTimestamp: ${new Date().toISOString()}\n\nPlease review the report and take appropriate action.`,
+            });
+            logger.info(`[LinkReports] Sent auto-block email to moderators for domain ${domain}`);
+        }
+        else {
+            logger.warn(`[LinkReports] No moderator notification configured (MODERATOR_WEBHOOK_URL or MODERATOR_EMAILS)`);
+        }
+    }
+    catch (error) {
+        logger.error("[LinkReports] Failed to notify moderators of auto-block:", error);
+        // Don't throw - notification failure shouldn't break report creation
+    }
+}
+//# sourceMappingURL=link-reports.js.map

package/dist/lib/routes/link-reports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-reports.js","sourceRoot":"","sources":["../../../src/lib/routes/link-reports.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,gDAAgE;AAChE,4EAAuE;AACvE,sDAAwD;AACxD,sCAAmC;AACnC,8CAA+D;AAC/D,8CAA4C;AAC5C,wDAA6C;AAC7C,0DAAsD;AACtD,wDAAoD;AACpD,8CAA0C;AAO7B,QAAA,gBAAgB,GAAY;IACvC;QACE,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE;YAC5D,MAAM,cAAc,GAAG,IAAI,gCAAc,EAAE,CAAC;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,WAAW,GAAG,IAAI,wBAAW,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,sBAAS,EAAE,CAAC;YAElC,uBAAuB;YACvB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAC7C,OAAO,EACP,yBAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAC7B,GAAU,CACX,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,oDAAoD;YACpD,MAAM,iBAAiB,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAC1D,GAAU,EACV,OAAO,EACP,eAAe,EACf,EAAE,EACF,IAAI,EACJ,OAAO,CAAC,MAAM,CACf,CAAC;YACF,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO,eAAe,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,CAAC;gBACH,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,EAC1D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACJ,CAAC;gBAED,sCAAsC;gBACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAC1B,iDAAiD,CAClD,CAAC;gBACF,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAC/C,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACxB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAExB,qBAAqB;gBACrB,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAEnD,CAAC;gBAEF,kCAAkC;gBAClC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,IAAI,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC;gBACnE,MAAM,EAAE,GAAG,wBAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBAExD,4CAA4C;gBAC5C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC;oBAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;oBACrB,OAAO,EAAE;wBACP,IAAI,EAAE;4BACJ,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;yBACtB;qBACF;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC9C,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAC3C,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACJ,CAAC;gBAED,0BAA0B;gBAC1B,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;oBACtE,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;oBACpC,qBAAqB;oBACrB,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC9B,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,CACT,sCAAsC,SAAS,CAAC,WAAW,EAAE,CAC9D,CAAC;oBACF,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAC7C,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACJ,CAAC;gBAED,qBAAqB;gBACrB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;oBACxC,IAAI,EAAE;wBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,OAAO,EAAE,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW;wBACzD,MAAM;wBACN,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;wBAC3B,MAAM,EAAE,SAAS;qBAClB;iBACF,CAAC,CAAC;gBAEH,6CAA6C;gBAC7C,MAAM,iBAAiB,GAAG,IAAI,mDAAuB,CAAC,GAAG,CAAC,CAAC;gBAC3D,MAAM,iBAAiB,CAAC,gBAAgB,CACtC,MAAM,EACN,aAAa,EACb,MAAM,EACN,GAAG,CACJ,CAAC;gBAEF,yCAAyC;gBACzC,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAC7D,MAAM,EACN,MAAM,EACN,GAAG,CACJ,CAAC;gBACF,IAAI,eAAe,EAAE,CAAC;oBACpB,MAAM,iBAAiB,CAAC,gBAAgB,CACtC,MAAM,EACN,YAAY,EACZ,MAAM,EACN,GAAG,CACJ,CAAC;oBACF,MAAM,CAAC,IAAI,CACT,qCAAqC,MAAM,0BAA0B,CACtE,CAAC;oBAEF,qCAAqC;oBACrC,MAAM,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBACpE,CAAC;gBAED,iBAAiB;gBACjB,MAAM,CAAC,IAAI,CACT,sBAAsB,OAAO,CAAC,MAAM,kBAAkB,MAAM,YAAY,MAAM,aAAa,MAAM,GAAG,CACrG,CAAC;gBAEF,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE;wBACN,EAAE,EAAE,MAAM,CAAC,EAAE;wBACb,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;qBAC1C;iBACF,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;gBAC5D,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EACzD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QAChD,WAAW,EAAE,yBAAyB;KACvC;IAED;QACE,IAAI,EAAE,oDAAoD;QAC1D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE;YAC5D,MAAM,cAAc,GAAG,IAAI,gCAAc,EAAE,CAAC;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,WAAW,GAAG,IAAI,wBAAW,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,sBAAS,EAAE,CAAC;YAElC,uBAAuB;YACvB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAC7C,OAAO,EACP,yBAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAC7B,GAAU,CACX,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,oDAAoD;YACpD,MAAM,iBAAiB,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAC1D,GAAU,EACV,OAAO,EACP,eAAe,EACf,EAAE,EACF,IAAI,EACJ,OAAO,CAAC,MAAM,CACf,CAAC;YACF,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO,eAAe,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,CAAC;gBACH,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,EAC1D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACJ,CAAC;gBAED,yCAAyC;gBACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAC1B,oDAAoD,CACrD,CAAC;gBACF,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAC/C,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAExB,qBAAqB;gBACrB,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAEnD,CAAC;gBAEF,kCAAkC;gBAClC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,IAAI,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC;gBACnE,MAAM,EAAE,GAAG,wBAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBAExD,4CAA4C;gBAC5C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC;oBAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;oBACrB,OAAO,EAAE;wBACP,OAAO,EAAE;4BACP,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;yBACzB;qBACF;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBACpD,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAC3C,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACJ,CAAC;gBAED,0BAA0B;gBAC1B,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;oBACtE,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;oBACpC,qBAAqB;oBACrB,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC9B,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,CACT,sCAAsC,SAAS,CAAC,WAAW,EAAE,CAC9D,CAAC;oBACF,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAC7C,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACJ,CAAC;gBAED,qBAAqB;gBACrB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;oBACxC,IAAI,EAAE;wBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,OAAO,EAAE,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW;wBACzD,MAAM;wBACN,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;wBAC3B,MAAM,EAAE,SAAS;qBAClB;iBACF,CAAC,CAAC;gBAEH,6CAA6C;gBAC7C,MAAM,iBAAiB,GAAG,IAAI,mDAAuB,CAAC,GAAG,CAAC,CAAC;gBAC3D,MAAM,iBAAiB,CAAC,gBAAgB,CACtC,MAAM,EACN,aAAa,EACb,MAAM,EACN,GAAG,CACJ,CAAC;gBAEF,yCAAyC;gBACzC,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAC7D,MAAM,EACN,MAAM,EACN,GAAG,CACJ,CAAC;gBACF,IAAI,eAAe,EAAE,CAAC;oBACpB,MAAM,iBAAiB,CAAC,gBAAgB,CACtC,MAAM,EACN,YAAY,EACZ,MAAM,EACN,GAAG,CACJ,CAAC;oBACF,MAAM,CAAC,IAAI,CACT,qCAAqC,MAAM,0BAA0B,CACtE,CAAC;oBAEF,qCAAqC;oBACrC,MAAM,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBACpE,CAAC;gBAED,iBAAiB;gBACjB,MAAM,CAAC,IAAI,CACT,sBAAsB,OAAO,CAAC,MAAM,kBAAkB,MAAM,eAAe,SAAS,aAAa,MAAM,GAAG,CAC3G,CAAC;gBAEF,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE;wBACN,EAAE,EAAE,MAAM,CAAC,EAAE;wBACb,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;qBAC1C;iBACF,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;gBAC5D,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EACzD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QAChD,WAAW,EAAE,4BAA4B;KAC1C;CACF,CAAC;AAEF;;GAEG;AACH,KAAK,UAAU,2BAA2B,CACxC,MAAc,EACd,QAAgB,EAChB,GAAQ,EACR,MAA6C;IAE7C,IAAI,CAAC;QACH,qCAAqC;QACrC,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,GAAG,CAAC,qBAAqB,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,qBAAqB;oBAC3B,MAAM;oBACN,QAAQ;oBACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,OAAO,EAAE,UAAU,MAAM,uFAAuF,QAAQ,GAAG;iBAC5H,CAAC;aACH,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CACT,uEAAuE,MAAM,EAAE,CAChF,CAAC;QACJ,CAAC;aAAM,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAChC,8CAA8C;YAC9C,MAAM,aAAa,GAAG,IAAA,oCAAmB,EAAC;gBACxC,QAAQ,EAAG,GAAG,CAAC,aAAqB,IAAI,QAAQ;gBAChD,YAAY,EAAE,GAAG,CAAC,cAAc;gBAChC,kBAAkB,EAAE,GAAG,CAAC,qBAAqB;gBAC7C,sBAAsB,EAAE,GAAG,CAAC,yBAAyB;gBACrD,aAAa,EAAE,GAAG,CAAC,cAAc;gBACjC,kBAAkB,EAAE,GAAG,CAAC,oBAAoB;gBAC5C,eAAe,EAAE,GAAG,CAAC,iBAAiB;gBACtC,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;gBACxC,aAAa,EAAE,GAAG,CAAC,cAAc;gBACjC,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;gBACxC,cAAc,EAAE,GAAG,CAAC,iBAAiB;gBACrC,kBAAkB,EAAE,GAAG,CAAC,qBAAqB;gBAC7C,SAAS,EAAE,GAAG,CAAC,UAAU;aAC1B,CAAC,CAAC;YAEH,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBACzD,CAAC,CAAC,GAAG,CAAC,gBAAgB;gBACtB,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAEjE,MAAM,aAAa,CAAC,SAAS,CAAC;gBAC5B,IAAI,EAAE,GAAG,CAAC,UAAU,IAAI,qBAAqB;gBAC7C,EAAE,EAAE,eAAe;gBACnB,OAAO,EAAE,wBAAwB,MAAM,EAAE;gBACzC,IAAI,EAAE;;kCAEoB,MAAM;2CACG,QAAQ;2CACR,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;;SAE1D;gBACD,IAAI,EAAE,wBAAwB,MAAM,kBAAkB,QAAQ,gBAAgB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,2DAA2D;aAClK,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CACT,gEAAgE,MAAM,EAAE,CACzE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,gGAAgG,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,0DAA0D,EAC1D,KAAK,CACN,CAAC;QACF,qEAAqE;IACvE,CAAC;AACH,CAAC"}

package/dist/lib/routes/map.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Map Routes
+ */
+import type { Route } from "./types";
+export declare const mapRoutes: Route[];
+//# sourceMappingURL=map.d.ts.map

package/dist/lib/routes/map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"map.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/map.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,eAAO,MAAM,SAAS,EAAE,KAAK,EAc5B,CAAC"}

package/dist/lib/routes/map.js

@@ -0,0 +1,21 @@
+"use strict";
+/**
+ * Map Routes
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mapRoutes = void 0;
+const middleware_1 = require("../middleware");
+const security_headers_1 = require("../security-headers");
+exports.mapRoutes = [
+    {
+        path: "/api/map/nearby",
+        method: "GET",
+        handler: async (request, env) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            return securityHeaders.createSecureResponse(JSON.stringify({ posts: [], error: "Not implemented - Milestone E" }), { status: 501, headers: { "content-type": "application/json" } });
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()],
+        description: "Get nearby posts on map",
+    },
+];
+//# sourceMappingURL=map.js.map

package/dist/lib/routes/map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"map.js","sourceRoot":"","sources":["../../../src/lib/routes/map.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,8CAA+C;AAC/C,0DAAsD;AAGzC,QAAA,SAAS,GAAY;IAChC;QACE,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,EACrE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,CAAC;QAC9B,WAAW,EAAE,yBAAyB;KACvC;CACF,CAAC"}

package/dist/lib/routes/media-metadata-visibility.d.ts

@@ -0,0 +1,3 @@
+import type { Route } from "./types";
+export declare const mediaMetadataVisibilityRoutes: Route[];
+//# sourceMappingURL=media-metadata-visibility.d.ts.map

package/dist/lib/routes/media-metadata-visibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-metadata-visibility.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/media-metadata-visibility.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAiBrC,eAAO,MAAM,6BAA6B,EAAE,KAAK,EAiLhD,CAAC"}

package/dist/lib/routes/media-metadata-visibility.js

@@ -0,0 +1,184 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mediaMetadataVisibilityRoutes = void 0;
+const cors_handler_1 = require("../cors-handler");
+const database_connection_manager_1 = require("../database-connection-manager");
+const db_query_helper_1 = require("../db-query-helper");
+const logger_1 = require("../logger");
+const middleware_1 = require("../middleware");
+const rate_limit_1 = require("../rate-limit");
+const secret_resolver_1 = require("../secret-resolver");
+const security_headers_1 = require("../security-headers");
+const session_manager_1 = require("../session-manager");
+const zod_1 = require("zod");
+const PatchVisibilitySchema = zod_1.z
+    .object({
+    metadataVisible: zod_1.z.boolean().optional(),
+    locationVisible: zod_1.z.boolean().optional(),
+})
+    .refine((v) => v.metadataVisible !== undefined || v.locationVisible !== undefined, {
+    message: "At least one of metadataVisible or locationVisible must be provided",
+});
+exports.mediaMetadataVisibilityRoutes = [
+    {
+        path: "/api/media/:mediaId/metadata-visibility",
+        method: "PATCH",
+        handler: async (request, env, context) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = logger_1.Logger.getInstance(env);
+            const rateLimiter = new rate_limit_1.RateLimiter();
+            const sessionManager = new session_manager_1.SessionManager();
+            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            if (!session) {
+                const res = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), {
+                    status: 401,
+                    headers: { "content-type": "application/json" },
+                });
+                return cors_handler_1.CorsHandler.addCorsHeaders(res, request, env);
+            }
+            // Rate limiting: 30/60s per user
+            const rateLimitResponse = await rateLimiter.applyRateLimitKV(env, request, "/api/media/:mediaId/metadata-visibility", 30, 60, session.userId);
+            if (rateLimitResponse) {
+                return securityHeaders.addSecurityHeaders(rateLimitResponse);
+            }
+            const mediaId = context.params?.mediaId;
+            if (!mediaId) {
+                const res = securityHeaders.createSecureResponse(JSON.stringify({
+                    error: "Invalid request",
+                    message: "Media ID is required",
+                }), { status: 400, headers: { "content-type": "application/json" } });
+                return cors_handler_1.CorsHandler.addCorsHeaders(res, request, env);
+            }
+            let bodyJson;
+            try {
+                bodyJson = await request.json();
+            }
+            catch {
+                const res = securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid JSON body" }), { status: 400, headers: { "content-type": "application/json" } });
+                return cors_handler_1.CorsHandler.addCorsHeaders(res, request, env);
+            }
+            const parsed = PatchVisibilitySchema.safeParse(bodyJson);
+            if (!parsed.success) {
+                const res = securityHeaders.createSecureResponse(JSON.stringify({
+                    error: "Validation error",
+                    issues: parsed.error.flatten(),
+                }), { status: 400, headers: { "content-type": "application/json" } });
+                return cors_handler_1.CorsHandler.addCorsHeaders(res, request, env);
+            }
+            const { RegionDetector } = await Promise.resolve().then(() => __importStar(require("../region-detection")));
+            const regionDetector = new RegionDetector(env);
+            const region = await regionDetector.detectRegion(request, undefined, undefined);
+            // Ownership: reuse MediaHandler.getMediaDetails ownership semantics
+            const { MediaHandler } = await Promise.resolve().then(() => __importStar(require("../media-handler")));
+            const mediaHandler = MediaHandler.create(env);
+            await mediaHandler.getMediaDetails(mediaId, session.userId, env, request);
+            const updated = await (0, db_query_helper_1.withQueryTimeoutAndRetry)(database_connection_manager_1.sharedDatabaseConnectionManager, region, env, async (db) => {
+                const dbAny = db;
+                return await dbAny.mediaFile.update({
+                    where: { id: mediaId },
+                    data: {
+                        ...(parsed.data.metadataVisible !== undefined
+                            ? { metadataVisible: parsed.data.metadataVisible }
+                            : {}),
+                        ...(parsed.data.locationVisible !== undefined
+                            ? { locationVisible: parsed.data.locationVisible }
+                            : {}),
+                    },
+                    select: {
+                        id: true,
+                        metadataVisible: true,
+                        locationVisible: true,
+                    },
+                });
+            }, {
+                ...db_query_helper_1.QueryTimeoutPresets.USER_FACING,
+                maxRetries: 3,
+                baseDelayMs: 100,
+                context: {
+                    operation: "patchMetadataVisibility",
+                    userId: session.userId,
+                    mediaId,
+                },
+            });
+            // Audit log best-effort
+            try {
+                const { AuditLogger } = await Promise.resolve().then(() => __importStar(require("../audit-logger")));
+                const auditLogger = new AuditLogger(env);
+                const ipAddress = request.headers.get("CF-Connecting-IP") ||
+                    request.headers.get("X-Forwarded-For")?.split(",")[0]?.trim() ||
+                    undefined;
+                const userAgent = request.headers.get("User-Agent") || undefined;
+                await auditLogger.log({
+                    type: "data_update",
+                    action: "media_metadata_visibility_updated",
+                    resource: "media",
+                    resourceId: mediaId,
+                    userId: session.userId,
+                    region,
+                    ipAddress,
+                    userAgent,
+                    metadata: {
+                        mediaId,
+                        ...parsed.data,
+                    },
+                    severity: "low",
+                    success: true,
+                }, env);
+            }
+            catch (e) {
+                logger.warn("[Media Visibility] Audit logging failed", {
+                    error: e?.message,
+                });
+            }
+            const res = securityHeaders.createSecureResponse(JSON.stringify({
+                success: true,
+                media: updated,
+            }), {
+                status: 200,
+                headers: {
+                    "content-type": "application/json",
+                    "cache-control": "no-cache, no-store, must-revalidate", // Don't cache state changes
+                    pragma: "no-cache",
+                    expires: "0",
+                },
+            });
+            return cors_handler_1.CorsHandler.addCorsHeaders(res, request, env);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Update per-media metadata/location visibility flags",
+    },
+];
+//# sourceMappingURL=media-metadata-visibility.js.map

package/dist/lib/routes/media-metadata-visibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-metadata-visibility.js","sourceRoot":"","sources":["../../../src/lib/routes/media-metadata-visibility.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA8C;AAC9C,gFAAiF;AACjF,wDAG4B;AAC5B,sCAAmC;AACnC,8CAA+D;AAC/D,8CAA4C;AAC5C,wDAA6C;AAC7C,0DAAsD;AACtD,wDAAoD;AAGpD,6BAAwB;AAExB,MAAM,qBAAqB,GAAG,OAAC;KAC5B,MAAM,CAAC;IACN,eAAe,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC,eAAe,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EACzE;IACE,OAAO,EACL,qEAAqE;CACxE,CACF,CAAC;AAES,QAAA,6BAA6B,GAAY;IACpD;QACE,IAAI,EAAE,yCAAyC;QAC/C,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;YACvC,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,WAAW,GAAG,IAAI,wBAAW,EAAE,CAAC;YACtC,MAAM,cAAc,GAAG,IAAI,gCAAc,EAAE,CAAC;YAE5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAC7C,OAAO,EACP,yBAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAC7B,GAAG,CACJ,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;gBACF,OAAO,0BAAW,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;YAED,iCAAiC;YACjC,MAAM,iBAAiB,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAC1D,GAAU,EACV,OAAO,EACP,yCAAyC,EACzC,EAAE,EACF,EAAE,EACF,OAAO,CAAC,MAAM,CACf,CAAC;YACF,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO,eAAe,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,sBAAsB;iBAChC,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACF,OAAO,0BAAW,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;YAED,IAAI,QAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,GAAG,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAC9C,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACF,OAAO,0BAAW,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,GAAG,GAAG,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,kBAAkB;oBACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;iBAC/B,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACF,OAAO,0BAAW,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,EAAE,cAAc,EAAE,GAAG,wDAAa,qBAAqB,GAAC,CAAC;YAC/D,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,YAAY,CAC9C,OAAO,EACP,SAAS,EACT,SAAS,CACV,CAAC;YAEF,oEAAoE;YACpE,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,kBAAkB,GAAC,CAAC;YAC1D,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9C,MAAM,YAAY,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAE1E,MAAM,OAAO,GAAG,MAAM,IAAA,0CAAwB,EAC5C,6DAA+B,EAC/B,MAAM,EACN,GAAU,EACV,KAAK,EAAE,EAAE,EAAE,EAAE;gBACX,MAAM,KAAK,GAAG,EAAS,CAAC;gBACxB,OAAO,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;oBAClC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;oBACtB,IAAI,EAAE;wBACJ,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS;4BAC3C,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;4BAClD,CAAC,CAAC,EAAE,CAAC;wBACP,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS;4BAC3C,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;4BAClD,CAAC,CAAC,EAAE,CAAC;qBACR;oBACD,MAAM,EAAE;wBACN,EAAE,EAAE,IAAI;wBACR,eAAe,EAAE,IAAI;wBACrB,eAAe,EAAE,IAAI;qBACtB;iBACF,CAAC,CAAC;YACL,CAAC,EACD;gBACE,GAAG,qCAAmB,CAAC,WAAW;gBAClC,UAAU,EAAE,CAAC;gBACb,WAAW,EAAE,GAAG;gBAChB,OAAO,EAAE;oBACP,SAAS,EAAE,yBAAyB;oBACpC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO;iBACR;aACF,CACF,CAAC;YAEF,wBAAwB;YACxB,IAAI,CAAC;gBACH,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,iBAAiB,GAAC,CAAC;gBACxD,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC;gBACzC,MAAM,SAAS,GACb,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;oBACvC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;oBAC7D,SAAS,CAAC;gBACZ,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;gBAEjE,MAAM,WAAW,CAAC,GAAG,CACnB;oBACE,IAAI,EAAE,aAAa;oBACnB,MAAM,EAAE,mCAAmC;oBAC3C,QAAQ,EAAE,OAAO;oBACjB,UAAU,EAAE,OAAO;oBACnB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM;oBACN,SAAS;oBACT,SAAS;oBACT,QAAQ,EAAE;wBACR,OAAO;wBACP,GAAG,MAAM,CAAC,IAAI;qBACf;oBACD,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,IAAI;iBACd,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;oBACrD,KAAK,EAAG,CAAS,EAAE,OAAO;iBAC3B,CAAC,CAAC;YACL,CAAC;YAED,MAAM,GAAG,GAAG,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,OAAO;aACf,CAAC,EACF;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,eAAe,EAAE,qCAAqC,EAAE,4BAA4B;oBACpF,MAAM,EAAE,UAAU;oBAClB,OAAO,EAAE,GAAG;iBACb;aACF,CACF,CAAC;YACF,OAAO,0BAAW,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QAChD,WAAW,EAAE,qDAAqD;KACnE;CACF,CAAC"}

package/dist/lib/routes/media.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Media Routes
+ *
+ * Handles media file uploads (images, videos) for posts and profiles.
+ * Implements content-addressed storage (CAS) with SHA-256 hashing for deduplication.
+ */
+import type { Route } from "./types";
+export declare const mediaRoutes: Route[];
+//# sourceMappingURL=media.d.ts.map

package/dist/lib/routes/media.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/media.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiBH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAipBrC,eAAO,MAAM,WAAW,EAAE,KAAK,EA+5D9B,CAAC"}