Harden bulk retries, parallelize guest uploads, and move guest map below gallery

packages/contracts/src/bulk-photos.test.ts

@@ -0,0 +1,20 @@
+import { expect, test } from "bun:test";
+import { applyBulkPhotosInputSchema, bulkPhotosInputSchema, createGalleryPhotosInputSchema } from "./index";
+
+test("bulk requests require confirmation, a receipt ID, a bounded unique selection, and a known action", () => {
+  const input = { eventId: crypto.randomUUID(), photoIds: [crypto.randomUUID()], action: "public", confirm: true, requestId: crypto.randomUUID() };
+  expect(applyBulkPhotosInputSchema.safeParse(input).success).toBe(true);
+  for (const change of [{ confirm: false }, { requestId: undefined }, { photoIds: [] }, { photoIds: [input.photoIds[0], input.photoIds[0]] }, { photoIds: Array.from({ length: 101 }, () => crypto.randomUUID()) }, { action: "publish-everything" }]) {
+    expect(applyBulkPhotosInputSchema.safeParse({ ...input, ...change }).success).toBe(false);
+  }
+  expect(bulkPhotosInputSchema.safeParse({ eventId: input.eventId, photoIds: input.photoIds, action: "delete" }).success).toBe(true);
+});
+
+test("organizer upload batches require bounded files and stable request IDs", () => {
+  const file = { fileName: "photo.jpg", contentType: "image/jpeg", byteSize: 500 };
+  const input = { eventId: crypto.randomUUID(), requestId: crypto.randomUUID(), files: [file] };
+  expect(createGalleryPhotosInputSchema.safeParse(input).success).toBe(true);
+  for (const change of [{ requestId: undefined }, { files: [] }, { files: Array(26).fill(file) }, { files: [{ ...file, byteSize: 0 }] }, { files: [{ ...file, contentType: "text/html" }] }]) {
+    expect(createGalleryPhotosInputSchema.safeParse({ ...input, ...change }).success).toBe(false);
+  }
+});

packages/contracts/src/bulk-photos.ts

@@ -5,4 +5,4 @@ export const bulkPhotosInputSchema = z.object({
   photoIds: z.array(z.string().uuid()).min(1).max(100).refine(ids => new Set(ids).size === ids.length, "Duplicate photo IDs"),
   action: z.enum(["public", "hidden", "private", "rejected", "delete"]),
 });
-export const applyBulkPhotosInputSchema = bulkPhotosInputSchema.extend({ confirm: z.literal(true) });
+export const applyBulkPhotosInputSchema = bulkPhotosInputSchema.extend({ confirm: z.literal(true), requestId: z.string().uuid() });

packages/contracts/src/index.ts

@@ -177,9 +177,11 @@ export const completePhotoInputSchema = z.object({
 
 export const createGalleryPhotosInputSchema = z.object({
   eventId: z.string().uuid(),
+  requestId: z.string().uuid(),
   files: z.array(createPhotoInputSchema.pick({ contentType: true, byteSize: true, fileName: true })).min(1).max(25),
 });
 export const completeGalleryPhotosInputSchema = z.object({ eventId: z.string().uuid(), photoIds: z.array(z.string().uuid()).min(1).max(25) });
+export const retryGalleryPhotoInputSchema = z.object({ eventId: z.string().uuid(), photoId: z.string().uuid() });
 
 export const BANNER_ASPECT_RATIO = 8 / 3;
 export const bannerCropSchema = z.object({