Merge branch 'security/audit-2026-07-07'

Security audit fixes: host privilege-boundary (demote-then-act), gated preview/thumbnail access for moderation, /recover enumeration + timing, periodic SSE session revalidation, app-layer nosniff, and svelte/devalue CVE bumps. 40 backend unit tests + 182 e2e passing.
2026-07-08 06:14:07 +02:00
parent 683b1b6f65 a4b2c5bd1c
commit 16d1f356be
13 changed files with 508 additions and 225 deletions
--- a/25
+++ b/25
@@ -17,19 +17,20 @@
 	@hashed_assets path_regexp hashed /_app/immutable/.*\.[a-f0-9]{8,}\.(js|css|woff2)$
 	header @hashed_assets Cache-Control "public, max-age=31536000, immutable"

-	# Media previews and thumbnails
-	@previews path /media/previews/* /media/thumbnails/*
-	header @previews Cache-Control "public, max-age=3600"
+	# Preview/thumbnail images. These are now served by the app through a
+	# visibility-checked alias (/api/v1/upload/{id}/{preview,thumbnail}) so moderation
+	# can revoke access; direct /media/previews|thumbnails is 404-blocked at the app.
+	# Privately cacheable for a short window (the app sets the same header; this is the
+	# edge carve-out from the blanket no-store below). Kept short so a moderated image
+	# stops being served to a direct-URL holder promptly.
+	@media_api path /api/v1/upload/*/preview /api/v1/upload/*/thumbnail
+	header @media_api Cache-Control "private, max-age=300"

-	# Original media files (private — only host can download). Force download
-	# rather than inline rendering as defense-in-depth against any future
-	# content-type confusion (previews/thumbnails are re-encoded and stay inline).
-	@originals path /media/originals/*
-	header @originals Cache-Control "private, max-age=86400"
-	header @originals Content-Disposition "attachment"
-
-	# API — never cache
-	@api path /api/*
+	# API — never cache, EXCEPT the gated image routes above.
+	@api {
+		path /api/*
+		not path /api/v1/upload/*/preview /api/v1/upload/*/thumbnail
+	}
 	header @api Cache-Control "no-store"

 	# Route API and media requests to the Rust backend
--- a/backend/src/auth/handlers.rs
+++ b/backend/src/auth/handlers.rs
@@ -121,6 +121,18 @@ pub struct RecoverResponse {
    pub user_id: Uuid,
 }

+/// A real cost-12 bcrypt hash of a fixed dummy value, computed once and cached. Used
+/// to run a constant-time-ish verify on the "unknown display name" branch of
+/// [`recover`], so that branch costs the same as a real (user-exists) verify and can't
+/// be told apart by timing.
+fn dummy_pin_hash() -> &'static str {
+    static HASH: std::sync::OnceLock<String> = std::sync::OnceLock::new();
+    HASH.get_or_init(|| {
+        bcrypt::hash("eventsnap-dummy-not-a-real-pin", 12)
+            .expect("bcrypt hashing of a static dummy value cannot fail")
+    })
+}
+
 pub async fn recover(
    State(state): State<AppState>,
    headers: HeaderMap,
@@ -158,9 +170,13 @@ pub async fn recover(
        User::find_by_event_and_name(&state.pool, event.id, display_name).await?;

    if users.is_empty() {
-        return Err(AppError::NotFound(
-            "Kein Benutzer mit diesem Namen gefunden.".into(),
-        ));
+        // No user with this name. Run a throwaway bcrypt verify so this branch takes
+        // the same time as the user-exists path, and return the SAME error as a wrong
+        // PIN — so "no such name" and "wrong PIN" are indistinguishable by response or
+        // timing. Display names are already public on the feed, but this still closes
+        // the /recover enumeration + timing oracle.
+        let _ = bcrypt::verify(&body.pin, dummy_pin_hash());
+        return Err(AppError::Unauthorized("PIN ist falsch.".into()));
    }

    for user in &users {
--- a/backend/src/handlers/feed.rs
+++ b/backend/src/handlers/feed.rs
@@ -139,8 +139,17 @@ pub async fn feed(
    let uploads = rows
        .into_iter()
        .map(|r| {
-            let preview_url = r.preview_path.map(|p| format!("/media/{p}"));
-            let thumbnail_url = r.thumbnail_path.map(|p| format!("/media/{p}"));
+            // Gated media aliases (visibility-checked, direct /media blocked). Emit the
+            // URL only when the variant actually exists — the URL is what signals the
+            // client which variant to load.
+            let preview_url = r
+                .preview_path
+                .as_ref()
+                .map(|_| format!("/api/v1/upload/{}/preview", r.id));
+            let thumbnail_url = r
+                .thumbnail_path
+                .as_ref()
+                .map(|_| format!("/api/v1/upload/{}/thumbnail", r.id));
            FeedUpload {
                liked_by_me: liked_set.contains(&r.id),
                id: r.id,
@@ -225,8 +234,14 @@ pub async fn feed_delta(
            id: r.id,
            user_id: r.user_id,
            uploader_name: r.uploader_name,
-            preview_url: r.preview_path.map(|p| format!("/media/{p}")),
-            thumbnail_url: r.thumbnail_path.map(|p| format!("/media/{p}")),
+            preview_url: r
+                .preview_path
+                .as_ref()
+                .map(|_| format!("/api/v1/upload/{}/preview", r.id)),
+            thumbnail_url: r
+                .thumbnail_path
+                .as_ref()
+                .map(|_| format!("/api/v1/upload/{}/thumbnail", r.id)),
            mime_type: r.mime_type,
            caption: r.caption,
            like_count: r.like_count,
--- a/backend/src/handlers/host.rs
+++ b/backend/src/handlers/host.rs
@@ -219,9 +219,14 @@ pub async fn set_role(
    .await?
    .ok_or_else(|| AppError::NotFound("Benutzer nicht gefunden.".into()))?;

-    if target.0 == "admin" {
+    // Admins are untouchable by hosts. A plain host also may not demote another
+    // *host*: without this guard a host could demote a peer host to guest and then
+    // ban / PIN-reset (→ account-takeover via /recover) them — the ban/pin-reset peer
+    // guards key off the target's *current* role, so a prior demotion would launder
+    // past them. Only an admin may change a host's role.
+    if target.0 == "admin" || (target.0 == "host" && auth.role != UserRole::Admin) {
        return Err(AppError::Forbidden(
-            "Admins können nicht geändert werden.".into(),
+            "Du darfst die Rolle dieses Benutzers nicht ändern.".into(),
        ));
    }

--- a/backend/src/handlers/sse.rs
+++ b/backend/src/handlers/sse.rs
@@ -59,7 +59,7 @@ pub async fn stream(
        .ok_or_else(|| AppError::Unauthorized("Sitzung nicht gefunden.".into()))?;

    let rx = state.sse_tx.subscribe();
-    let stream = BroadcastStream::new(rx).filter_map(|msg| match msg {
+    let events = BroadcastStream::new(rx).filter_map(|msg| match msg {
        Ok(sse_event) => Some(Ok(Event::default()
            .event(sse_event.event_type)
            .data(sse_event.data))),
@@ -73,6 +73,29 @@ pub async fn stream(
        }
    });

+    // The session is only checked once at open. Re-validate it periodically so a
+    // logged-out or expired session's stream is closed rather than kept alive until the
+    // client happens to disconnect. Bounds a stale stream to ~60s. Only a *definitively*
+    // gone/expired session ends the stream; a transient DB error just retries next tick.
+    let pool = state.pool.clone();
+    let session_hash = token_hash.clone();
+    let session_gone = async move {
+        let mut ticker = tokio::time::interval(Duration::from_secs(60));
+        ticker.tick().await; // consume the immediate first tick
+        loop {
+            ticker.tick().await;
+            match Session::find_by_token_hash(&pool, &session_hash).await {
+                Ok(Some(_)) => {}   // still valid — keep streaming
+                Ok(None) => break,  // logged out or expired — stop
+                Err(e) => {
+                    tracing::warn!(error = ?e, "SSE session revalidation query failed; retrying");
+                }
+            }
+        }
+    };
+
+    let stream = futures::StreamExt::take_until(events, Box::pin(session_gone));
+
    Ok(Sse::new(stream).keep_alive(
        KeepAlive::new()
            .interval(Duration::from_secs(30))
--- a/backend/src/handlers/upload.rs
+++ b/backend/src/handlers/upload.rs
@@ -527,35 +527,26 @@ pub async fn compute_storage_quota(state: &AppState) -> QuotaEstimate {
    }
 }

-/// Streaming download of the original file behind an upload. Used by:
-///   - the per-post "Original anzeigen" context action (`window.open`)
-///   - `<img src>` / `<video src>` in the feed, lightbox, and diashow when the user is in
-///     Data Mode = Original
-///
-/// **Auth model:** the route is intentionally unauthenticated so it works from
-/// `<img src>` / `window.open`, matching how preview + thumbnail variants are served.
-/// The URL contains the upload's unguessable UUID. Unlike raw `/media` files, this
-/// alias is the *only* way to fetch an original: direct `/media/originals/**` access is
-/// blocked in the router, and this handler filters out soft-deleted and ban-hidden
-/// uploads (via `find_by_id_visible`) so moderation actually removes access to content.
-pub async fn get_original(
-    State(state): State<AppState>,
-    Path(upload_id): Path<Uuid>,
+/// Stream a media file from disk into an HTTP response with a fixed set of security
+/// headers. Every media response (original, preview, thumbnail) goes through here so
+/// they consistently carry `X-Content-Type-Options: nosniff` (defense-in-depth against
+/// content-type confusion, even if the edge proxy is bypassed) plus an explicit
+/// `Content-Disposition` and `Cache-Control`.
+async fn stream_media_file(
+    absolute: &std::path::Path,
+    content_type: String,
+    disposition: &str,
+    cache_control: &str,
 ) -> Result<axum::response::Response, AppError> {
-    let upload = Upload::find_by_id_visible(&state.pool, upload_id)
-        .await?
-        .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
-
-    let absolute = state.config.media_path.join(&upload.original_path);
-    if !absolute.exists() {
-        return Err(AppError::NotFound("Datei nicht gefunden.".into()));
-    }
-
    use axum::body::Body;
    use axum::http::{header, Response, StatusCode};
    use tokio_util::io::ReaderStream;

-    let file = tokio::fs::File::open(&absolute)
+    if !absolute.exists() {
+        return Err(AppError::NotFound("Datei nicht gefunden.".into()));
+    }
+
+    let file = tokio::fs::File::open(absolute)
        .await
        .map_err(|e| AppError::Internal(e.into()))?;
    let metadata = file
@@ -564,19 +555,86 @@ pub async fn get_original(
        .map_err(|e| AppError::Internal(e.into()))?;
    let stream = ReaderStream::new(file);

+    Response::builder()
+        .status(StatusCode::OK)
+        .header(header::CONTENT_TYPE, content_type)
+        .header(header::CONTENT_DISPOSITION, disposition)
+        .header(header::CONTENT_LENGTH, metadata.len())
+        .header(header::CACHE_CONTROL, cache_control)
+        .header(header::X_CONTENT_TYPE_OPTIONS, "nosniff")
+        .body(Body::from_stream(stream))
+        .map_err(|e| AppError::Internal(e.into()))
+}
+
+/// Streaming download of the original file behind an upload. Used by:
+///   - the per-post "Original anzeigen" context action (`window.open`)
+///   - `<img src>` / `<video src>` in the feed, lightbox, and diashow when the user is in
+///     Data Mode = Original
+///
+/// **Auth model:** the route is intentionally unauthenticated so it works from
+/// `<img src>` / `window.open`. The URL contains the upload's unguessable UUID. Unlike
+/// raw `/media` files, this alias is the *only* way to fetch an original: direct
+/// `/media/originals/**` access is blocked in the router, and this handler filters out
+/// soft-deleted and ban-hidden uploads (via `find_visible_media`) so moderation actually
+/// removes access to content. Preview and thumbnail variants are gated the same way (see
+/// [`get_preview`] / [`get_thumbnail`]).
+pub async fn get_original(
+    State(state): State<AppState>,
+    Path(upload_id): Path<Uuid>,
+) -> Result<axum::response::Response, AppError> {
+    let media = Upload::find_visible_media(&state.pool, upload_id)
+        .await?
+        .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
+
+    let absolute = state.config.media_path.join(&media.original_path);
    let filename = absolute
        .file_name()
        .and_then(|n| n.to_str())
        .unwrap_or("original");
    let disposition = format!("attachment; filename=\"{filename}\"");

-    Response::builder()
-        .status(StatusCode::OK)
-        .header(header::CONTENT_TYPE, upload.mime_type)
-        .header(header::CONTENT_DISPOSITION, disposition)
-        .header(header::CONTENT_LENGTH, metadata.len())
-        .body(Body::from_stream(stream))
-        .map_err(|e| AppError::Internal(e.into()))
+    // Full-res original: force download, never cache at the edge.
+    stream_media_file(&absolute, media.mime_type, &disposition, "no-store").await
+}
+
+/// Streaming access to an upload's compressed **preview** image. Gated exactly like
+/// [`get_original`]: `find_visible_media` drops soft-deleted / ban-hidden uploads, so a
+/// deleted or moderated post's preview 404s here even though the file may still be on
+/// disk. Direct `/media/previews/**` is blocked in the router, making this the only path
+/// to a preview.
+///
+/// Served inline (it's an `<img src>`) and privately cacheable for a short window. The
+/// window is intentionally short (5 min) so a moderated image stops being served to a
+/// direct-URL holder promptly; the live feed already evicts the card instantly via the
+/// `upload-deleted` / `user-hidden` SSE events, so this only bounds the raw-URL edge case.
+pub async fn get_preview(
+    State(state): State<AppState>,
+    Path(upload_id): Path<Uuid>,
+) -> Result<axum::response::Response, AppError> {
+    let media = Upload::find_visible_media(&state.pool, upload_id)
+        .await?
+        .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
+    let rel = media
+        .preview_path
+        .ok_or_else(|| AppError::NotFound("Vorschau nicht verfügbar.".into()))?;
+    let absolute = state.config.media_path.join(&rel);
+    stream_media_file(&absolute, "image/jpeg".to_string(), "inline", "private, max-age=300").await
+}
+
+/// Streaming access to an upload's **thumbnail** (video poster). Gated identically to
+/// [`get_preview`].
+pub async fn get_thumbnail(
+    State(state): State<AppState>,
+    Path(upload_id): Path<Uuid>,
+) -> Result<axum::response::Response, AppError> {
+    let media = Upload::find_visible_media(&state.pool, upload_id)
+        .await?
+        .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
+    let rel = media
+        .thumbnail_path
+        .ok_or_else(|| AppError::NotFound("Thumbnail nicht verfügbar.".into()))?;
+    let absolute = state.config.media_path.join(&rel);
+    stream_media_file(&absolute, "image/jpeg".to_string(), "inline", "private, max-age=300").await
 }

 #[cfg(test)]
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -77,6 +77,17 @@ async fn main() -> Result<()> {
            "/api/v1/upload/{id}/original",
            get(handlers::upload::get_original),
        )
+        // Preview/thumbnail variants are gated the same way as originals (visibility
+        // check + direct /media block below) so moderation actually revokes access to
+        // the displayed images, not just the full-res download.
+        .route(
+            "/api/v1/upload/{id}/preview",
+            get(handlers::upload::get_preview),
+        )
+        .route(
+            "/api/v1/upload/{id}/thumbnail",
+            get(handlers::upload::get_thumbnail),
+        )
        // Current-user endpoints (live quota estimate, profile + privacy note bundle)
        .route("/api/v1/me/context", get(handlers::me::get_context))
        .route("/api/v1/me/quota", get(handlers::me::get_quota))
@@ -145,16 +156,26 @@ async fn main() -> Result<()> {
    let router = Router::new()
        .route("/health", get(|| async { "ok" }))
        .merge(api)
-        // Block direct HTTP access to originals. They live under `media_path` (so the
-        // compression worker and export can read them off disk) but must NOT be pullable
-        // straight from `/media/originals/**` — that would bypass the visibility checks in
-        // `get_original` (soft-delete + ban-hide). Every legitimate original fetch goes
-        // through `/api/v1/upload/{id}/original`; previews/thumbnails under `/media` stay
-        // public. The more specific nest takes precedence over `/media` below.
+        // Block direct HTTP access to ALL media subtrees. The files live under
+        // `media_path` (so the compression worker and export can read them off disk) but
+        // must NOT be pullable straight from `/media/**` — that bypasses the visibility
+        // checks (soft-delete + ban-hide) in the gated handlers. Every legitimate fetch
+        // goes through `/api/v1/upload/{id}/{original,preview,thumbnail}`, which filter
+        // via `find_visible_media`. The more specific nests take precedence over the
+        // `/media` ServeDir below (which, with all three subtrees blocked, now serves
+        // nothing — kept as a backstop).
        .nest_service(
            "/media/originals",
            get(|| async { axum::http::StatusCode::NOT_FOUND }),
        )
+        .nest_service(
+            "/media/previews",
+            get(|| async { axum::http::StatusCode::NOT_FOUND }),
+        )
+        .nest_service(
+            "/media/thumbnails",
+            get(|| async { axum::http::StatusCode::NOT_FOUND }),
+        )
        .nest_service("/media", media_service)
        .layer(TraceLayer::new_for_http())
        .with_state(state);
--- a/backend/src/models/upload.rs
+++ b/backend/src/models/upload.rs
@@ -35,6 +35,16 @@ pub struct UploadDto {
    pub created_at: DateTime<Utc>,
 }

+/// Minimal projection of an upload's on-disk file paths, used by the visibility-gated
+/// media aliases so they don't hydrate the entire `Upload` row per request.
+#[derive(Debug, sqlx::FromRow)]
+pub struct VisibleMedia {
+    pub original_path: String,
+    pub preview_path: Option<String>,
+    pub thumbnail_path: Option<String>,
+    pub mime_type: String,
+}
+
 impl Upload {
    /// Takes any executor so the caller can run it inside a transaction (atomic
    /// quota + insert) or standalone against the pool.
@@ -74,14 +84,22 @@ impl Upload {
        .await
    }

-    /// Like [`Self::find_by_id`] but also excludes uploads whose owner has been
-    /// ban-hidden (`user.uploads_hidden`). Used by the public original-file alias
-    /// so that moderation which hides a user's content from the feed/export also
-    /// stops their full-resolution originals from being pulled by UUID. Mirrors the
-    /// `uploads_hidden` filter that `v_feed` already applies to the feed.
-    pub async fn find_by_id_visible(pool: &PgPool, id: Uuid) -> Result<Option<Self>, sqlx::Error> {
-        sqlx::query_as::<_, Self>(
-            "SELECT up.* FROM upload up
+    /// Lean lookup for the public media aliases (`get_original`/`get_preview`/
+    /// `get_thumbnail`): returns ONLY the file paths + mime for a visible upload —
+    /// excluding soft-deleted rows and ban-hidden owners (`user.uploads_hidden`), the
+    /// same filter `v_feed` applies. So moderation that removes a post from the feed
+    /// also stops its original/preview/thumbnail from being pulled by UUID.
+    ///
+    /// Selects four columns instead of the whole `Upload` row: this runs once per image
+    /// per cache-miss on the media hot path, so we avoid hydrating fields the response
+    /// never uses.
+    pub async fn find_visible_media(
+        pool: &PgPool,
+        id: Uuid,
+    ) -> Result<Option<VisibleMedia>, sqlx::Error> {
+        sqlx::query_as::<_, VisibleMedia>(
+            "SELECT up.original_path, up.preview_path, up.thumbnail_path, up.mime_type
+             FROM upload up
             JOIN \"user\" u ON u.id = up.user_id
             WHERE up.id = $1 AND up.deleted_at IS NULL AND u.uploads_hidden = false",
        )
--- a/e2e/specs/01-auth/recover-enumeration.spec.ts
+++ b/e2e/specs/01-auth/recover-enumeration.spec.ts
@@ -0,0 +1,26 @@
+/**
+ * Security fix F4: /recover no longer leaks whether a display name exists. Previously an
+ * unknown name returned 404 ("Kein Benutzer …") while an existing name + wrong PIN
+ * returned 401 ("PIN ist falsch") — a response (and bcrypt-timing) oracle for account
+ * enumeration. Now both return an identical 401.
+ */
+import { test, expect } from '../../fixtures/test';
+
+test.describe('Auth — recover does not leak account existence (F4)', () => {
+  test('unknown name and wrong PIN both return an identical 401', async ({ api, guest }) => {
+    // Establish the event + a real user first (a truncate wipes the event row; the join
+    // recreates it — otherwise recover 404s on "event not found" before name resolution).
+    const g = await guest('RealPerson');
+
+    // Unknown display name → 401 "PIN ist falsch" (NOT a 404 revealing non-existence).
+    const unknown = await api.recover('NoSuchPersonXYZ', '0000', { expectedStatus: [401] });
+    expect(unknown.status).toBe(401);
+    expect(JSON.stringify(unknown.body)).toContain('PIN');
+
+    // A real user with a wrong PIN returns the same 401 shape.
+    const wrongPin = g.pin === '0001' ? '0002' : '0001';
+    const wrong = await api.recover('RealPerson', wrongPin, { expectedStatus: [401] });
+    expect(wrong.status).toBe(401);
+    expect(JSON.stringify(wrong.body)).toContain('PIN');
+  });
+});
--- a/e2e/specs/07-adversarial/media-gating.spec.ts
+++ b/e2e/specs/07-adversarial/media-gating.spec.ts
@@ -0,0 +1,59 @@
+/**
+ * Security fix F2: preview/thumbnail images are now served through a visibility-checked
+ * alias (/api/v1/upload/{id}/preview) instead of the unauthenticated /media ServeDir,
+ * so moderation (delete / ban-hide) actually revokes access to the displayed image —
+ * not just the full-res original. Direct /media/previews access is blocked.
+ */
+import { test, expect } from '../../fixtures/test';
+import { seedUpload } from '../../helpers/seed';
+
+const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+
+test.describe('Media gating — moderation revokes preview access (F2)', () => {
+  test('preview served via gated alias, blocked directly, and 404 after delete', async ({
+    host,
+    api,
+  }) => {
+    test.setTimeout(30_000);
+    const id = await seedUpload(host.jwt, { caption: 'gated' });
+
+    // Wait for the compression worker to produce the preview — the feed exposes
+    // `preview_url` only once `preview_path` is set.
+    let previewUrl: string | undefined;
+    await expect
+      .poll(
+        async () => {
+          const feed = await api.getFeed(host.jwt);
+          const row = (feed.uploads ?? []).find((u: any) => u.id === id);
+          previewUrl = row?.preview_url ?? undefined;
+          return previewUrl;
+        },
+        { timeout: 20_000, intervals: [500] }
+      )
+      .toBeTruthy();
+
+    // Feed now emits the gated alias, not a /media path.
+    expect(previewUrl).toBe(`/api/v1/upload/${id}/preview`);
+
+    // The gated alias serves the image with the app-layer nosniff header.
+    const ok = await fetch(`${BASE}${previewUrl}`);
+    expect(ok.status).toBe(200);
+    expect(ok.headers.get('content-type')).toContain('image/jpeg');
+    // App sets nosniff (F6); the edge proxy may also set it → value can be doubled.
+    expect(ok.headers.get('x-content-type-options')).toContain('nosniff');
+
+    // Direct /media access is blocked (404) — the alias is the only way in.
+    const direct = await fetch(`${BASE}/media/previews/${id}.jpg`);
+    expect(direct.status, 'direct /media/previews must be blocked').toBe(404);
+
+    // Host deletes the upload → the preview must stop being served.
+    const del = await fetch(`${BASE}/api/v1/host/upload/${id}`, {
+      method: 'DELETE',
+      headers: { Authorization: `Bearer ${host.jwt}` },
+    });
+    expect(del.status).toBe(204);
+
+    const afterDelete = await fetch(`${BASE}/api/v1/upload/${id}/preview`);
+    expect(afterDelete.status, 'moderation must revoke preview access').toBe(404);
+  });
+});
--- a/e2e/specs/07-adversarial/set-role-host-demote.spec.ts
+++ b/e2e/specs/07-adversarial/set-role-host-demote.spec.ts
@@ -0,0 +1,45 @@
+/**
+ * Security fix F1: a plain host must not be able to demote a *peer host*. Before the
+ * fix, `set_role` only blocked `target == admin`, so a host could demote another host
+ * to guest and then ban / PIN-reset (→ account takeover via /recover) them, because the
+ * ban/pin-reset peer guards key off the target's *current* role. This proves the
+ * demotion itself is now blocked for non-admins, while admins and guest-management
+ * still work.
+ */
+import { test, expect } from '../../fixtures/test';
+
+const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+
+function patchRole(token: string, userId: string, role: string) {
+  return fetch(`${BASE}/api/v1/host/users/${userId}/role`, {
+    method: 'PATCH',
+    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+    body: JSON.stringify({ role }),
+  });
+}
+
+test.describe('AuthZ — host cannot demote a peer host (F1)', () => {
+  test('host→host demotion is 403; admin may demote; host may still manage guests', async ({
+    host,
+    guest,
+    adminToken,
+    api,
+  }) => {
+    // A second host (the victim) and an ordinary guest.
+    const peer = await guest('PeerHost');
+    await api.setRole(adminToken, peer.userId, 'host');
+    const plain = await guest('PlainGuest');
+
+    // Attacker host tries to demote the peer host — must be refused.
+    const attack = await patchRole(host.jwt, peer.userId, 'guest');
+    expect(attack.status, 'a host must not be able to demote a peer host').toBe(403);
+
+    // An admin may still demote a host.
+    const byAdmin = await patchRole(adminToken, peer.userId, 'guest');
+    expect(byAdmin.status).toBe(204);
+
+    // A host may still manage guests (promote one to host).
+    const promote = await patchRole(host.jwt, plain.userId, 'host');
+    expect(promote.status).toBe(204);
+  });
+});
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -233,9 +233,9 @@
 			}
 		},
 		"node_modules/@esbuild/aix-ppc64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.4.tgz",
-			"integrity": "sha512-cQPwL2mp2nSmHHJlCyoXgHGhbEPMrEEU5xhkcy3Hs/O7nGZqEpZ2sUtLaL9MORLtDfRvVl2/3PAuEkYZH0Ty8Q==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
+			"integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
 			"cpu": [
 				"ppc64"
 			],
@@ -250,9 +250,9 @@
 			}
 		},
 		"node_modules/@esbuild/android-arm": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.4.tgz",
-			"integrity": "sha512-X9bUgvxiC8CHAGKYufLIHGXPJWnr0OCdR0anD2e21vdvgCI8lIfqFbnoeOz7lBjdrAGUhqLZLcQo6MLhTO2DKQ==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
+			"integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
 			"cpu": [
 				"arm"
 			],
@@ -267,9 +267,9 @@
 			}
 		},
 		"node_modules/@esbuild/android-arm64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.4.tgz",
-			"integrity": "sha512-gdLscB7v75wRfu7QSm/zg6Rx29VLdy9eTr2t44sfTW7CxwAtQghZ4ZnqHk3/ogz7xao0QAgrkradbBzcqFPasw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
+			"integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
 			"cpu": [
 				"arm64"
 			],
@@ -284,9 +284,9 @@
 			}
 		},
 		"node_modules/@esbuild/android-x64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.4.tgz",
-			"integrity": "sha512-PzPFnBNVF292sfpfhiyiXCGSn9HZg5BcAz+ivBuSsl6Rk4ga1oEXAamhOXRFyMcjwr2DVtm40G65N3GLeH1Lvw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
+			"integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
 			"cpu": [
 				"x64"
 			],
@@ -301,9 +301,9 @@
 			}
 		},
 		"node_modules/@esbuild/darwin-arm64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.4.tgz",
-			"integrity": "sha512-b7xaGIwdJlht8ZFCvMkpDN6uiSmnxxK56N2GDTMYPr2/gzvfdQN8rTfBsvVKmIVY/X7EM+/hJKEIbbHs9oA4tQ==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
+			"integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
 			"cpu": [
 				"arm64"
 			],
@@ -318,9 +318,9 @@
 			}
 		},
 		"node_modules/@esbuild/darwin-x64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.4.tgz",
-			"integrity": "sha512-sR+OiKLwd15nmCdqpXMnuJ9W2kpy0KigzqScqHI3Hqwr7IXxBp3Yva+yJwoqh7rE8V77tdoheRYataNKL4QrPw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
+			"integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
 			"cpu": [
 				"x64"
 			],
@@ -335,9 +335,9 @@
 			}
 		},
 		"node_modules/@esbuild/freebsd-arm64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.4.tgz",
-			"integrity": "sha512-jnfpKe+p79tCnm4GVav68A7tUFeKQwQyLgESwEAUzyxk/TJr4QdGog9sqWNcUbr/bZt/O/HXouspuQDd9JxFSw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
+			"integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
 			"cpu": [
 				"arm64"
 			],
@@ -352,9 +352,9 @@
 			}
 		},
 		"node_modules/@esbuild/freebsd-x64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.4.tgz",
-			"integrity": "sha512-2kb4ceA/CpfUrIcTUl1wrP/9ad9Atrp5J94Lq69w7UwOMolPIGrfLSvAKJp0RTvkPPyn6CIWrNy13kyLikZRZQ==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
+			"integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
 			"cpu": [
 				"x64"
 			],
@@ -369,9 +369,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-arm": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.4.tgz",
-			"integrity": "sha512-aBYgcIxX/wd5n2ys0yESGeYMGF+pv6g0DhZr3G1ZG4jMfruU9Tl1i2Z+Wnj9/KjGz1lTLCcorqE2viePZqj4Eg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
+			"integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
 			"cpu": [
 				"arm"
 			],
@@ -386,9 +386,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-arm64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.4.tgz",
-			"integrity": "sha512-7nQOttdzVGth1iz57kxg9uCz57dxQLHWxopL6mYuYthohPKEK0vU0C3O21CcBK6KDlkYVcnDXY099HcCDXd9dA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
+			"integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
 			"cpu": [
 				"arm64"
 			],
@@ -403,9 +403,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-ia32": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.4.tgz",
-			"integrity": "sha512-oPtixtAIzgvzYcKBQM/qZ3R+9TEUd1aNJQu0HhGyqtx6oS7qTpvjheIWBbes4+qu1bNlo2V4cbkISr8q6gRBFA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
+			"integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
 			"cpu": [
 				"ia32"
 			],
@@ -420,9 +420,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-loong64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.4.tgz",
-			"integrity": "sha512-8mL/vh8qeCoRcFH2nM8wm5uJP+ZcVYGGayMavi8GmRJjuI3g1v6Z7Ni0JJKAJW+m0EtUuARb6Lmp4hMjzCBWzA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
+			"integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
 			"cpu": [
 				"loong64"
 			],
@@ -437,9 +437,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-mips64el": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.4.tgz",
-			"integrity": "sha512-1RdrWFFiiLIW7LQq9Q2NES+HiD4NyT8Itj9AUeCl0IVCA459WnPhREKgwrpaIfTOe+/2rdntisegiPWn/r/aAw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
+			"integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
 			"cpu": [
 				"mips64el"
 			],
@@ -454,9 +454,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-ppc64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.4.tgz",
-			"integrity": "sha512-tLCwNG47l3sd9lpfyx9LAGEGItCUeRCWeAx6x2Jmbav65nAwoPXfewtAdtbtit/pJFLUWOhpv0FpS6GQAmPrHA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
+			"integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
 			"cpu": [
 				"ppc64"
 			],
@@ -471,9 +471,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-riscv64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.4.tgz",
-			"integrity": "sha512-BnASypppbUWyqjd1KIpU4AUBiIhVr6YlHx/cnPgqEkNoVOhHg+YiSVxM1RLfiy4t9cAulbRGTNCKOcqHrEQLIw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
+			"integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
 			"cpu": [
 				"riscv64"
 			],
@@ -488,9 +488,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-s390x": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.4.tgz",
-			"integrity": "sha512-+eUqgb/Z7vxVLezG8bVB9SfBie89gMueS+I0xYh2tJdw3vqA/0ImZJ2ROeWwVJN59ihBeZ7Tu92dF/5dy5FttA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
+			"integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
 			"cpu": [
 				"s390x"
 			],
@@ -505,9 +505,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-x64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.4.tgz",
-			"integrity": "sha512-S5qOXrKV8BQEzJPVxAwnryi2+Iq5pB40gTEIT69BQONqR7JH1EPIcQ/Uiv9mCnn05jff9umq/5nqzxlqTOg9NA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
+			"integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
 			"cpu": [
 				"x64"
 			],
@@ -522,9 +522,9 @@
 			}
 		},
 		"node_modules/@esbuild/netbsd-arm64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.4.tgz",
-			"integrity": "sha512-xHT8X4sb0GS8qTqiwzHqpY00C95DPAq7nAwX35Ie/s+LO9830hrMd3oX0ZMKLvy7vsonee73x0lmcdOVXFzd6Q==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
+			"integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
 			"cpu": [
 				"arm64"
 			],
@@ -539,9 +539,9 @@
 			}
 		},
 		"node_modules/@esbuild/netbsd-x64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.4.tgz",
-			"integrity": "sha512-RugOvOdXfdyi5Tyv40kgQnI0byv66BFgAqjdgtAKqHoZTbTF2QqfQrFwa7cHEORJf6X2ht+l9ABLMP0dnKYsgg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
+			"integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
 			"cpu": [
 				"x64"
 			],
@@ -556,9 +556,9 @@
 			}
 		},
 		"node_modules/@esbuild/openbsd-arm64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.4.tgz",
-			"integrity": "sha512-2MyL3IAaTX+1/qP0O1SwskwcwCoOI4kV2IBX1xYnDDqthmq5ArrW94qSIKCAuRraMgPOmG0RDTA74mzYNQA9ow==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
+			"integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
 			"cpu": [
 				"arm64"
 			],
@@ -573,9 +573,9 @@
 			}
 		},
 		"node_modules/@esbuild/openbsd-x64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.4.tgz",
-			"integrity": "sha512-u8fg/jQ5aQDfsnIV6+KwLOf1CmJnfu1ShpwqdwC0uA7ZPwFws55Ngc12vBdeUdnuWoQYx/SOQLGDcdlfXhYmXQ==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
+			"integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
 			"cpu": [
 				"x64"
 			],
@@ -590,9 +590,9 @@
 			}
 		},
 		"node_modules/@esbuild/openharmony-arm64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.4.tgz",
-			"integrity": "sha512-JkTZrl6VbyO8lDQO3yv26nNr2RM2yZzNrNHEsj9bm6dOwwu9OYN28CjzZkH57bh4w0I2F7IodpQvUAEd1mbWXg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
+			"integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
 			"cpu": [
 				"arm64"
 			],
@@ -607,9 +607,9 @@
 			}
 		},
 		"node_modules/@esbuild/sunos-x64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.4.tgz",
-			"integrity": "sha512-/gOzgaewZJfeJTlsWhvUEmUG4tWEY2Spp5M20INYRg2ZKl9QPO3QEEgPeRtLjEWSW8FilRNacPOg8R1uaYkA6g==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
+			"integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
 			"cpu": [
 				"x64"
 			],
@@ -624,9 +624,9 @@
 			}
 		},
 		"node_modules/@esbuild/win32-arm64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.4.tgz",
-			"integrity": "sha512-Z9SExBg2y32smoDQdf1HRwHRt6vAHLXcxD2uGgO/v2jK7Y718Ix4ndsbNMU/+1Qiem9OiOdaqitioZwxivhXYg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
+			"integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
 			"cpu": [
 				"arm64"
 			],
@@ -641,9 +641,9 @@
 			}
 		},
 		"node_modules/@esbuild/win32-ia32": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.4.tgz",
-			"integrity": "sha512-DAyGLS0Jz5G5iixEbMHi5KdiApqHBWMGzTtMiJ72ZOLhbu/bzxgAe8Ue8CTS3n3HbIUHQz/L51yMdGMeoxXNJw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
+			"integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
 			"cpu": [
 				"ia32"
 			],
@@ -658,9 +658,9 @@
 			}
 		},
 		"node_modules/@esbuild/win32-x64": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.4.tgz",
-			"integrity": "sha512-+knoa0BDoeXgkNvvV1vvbZX4+hizelrkwmGJBdT17t8FNPwG2lKemmuMZlmaNQ3ws3DKKCxpb4zRZEIp3UxFCg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
+			"integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
 			"cpu": [
 				"x64"
 			],
@@ -1208,9 +1208,9 @@
 			"license": "MIT"
 		},
 		"node_modules/@sveltejs/acorn-typescript": {
-			"version": "1.0.9",
-			"resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.9.tgz",
-			"integrity": "sha512-lVJX6qEgs/4DOcRTpo56tmKzVPtoWAaVbL4hfO7t7NVwl9AAXzQR6cihesW1BmNMPl+bK6dreu2sOKBP2Q9CIA==",
+			"version": "1.0.11",
+			"resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.11.tgz",
+			"integrity": "sha512-LFuZUkjJ9iF7JZye/aG5XM0SFcQ5VyL0oVX4WJ9dc0Va3R3s0OauX1BESVCb+YN/ol8TAfqGDDAQsTG627Y5kw==",
 			"license": "MIT",
 			"peerDependencies": {
 				"acorn": "^8.9.0"
@@ -1243,18 +1243,18 @@
 			}
 		},
 		"node_modules/@sveltejs/kit": {
-			"version": "2.55.0",
-			"resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.55.0.tgz",
-			"integrity": "sha512-MdFRjevVxmAknf2NbaUkDF16jSIzXMWd4Nfah0Qp8TtQVoSp3bV4jKt8mX7z7qTUTWvgSaxtR0EG5WJf53gcuA==",
+			"version": "2.69.1",
+			"resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.69.1.tgz",
+			"integrity": "sha512-+nz8Fx/cElzb2ZPHC+6Ll3y3NEVIe4Na75PeplLlyTmd1dBXAjz2KR14y1ZgNjb2ThfAYzulu+PFy1UE3RCUzA==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"@standard-schema/spec": "^1.0.0",
-				"@sveltejs/acorn-typescript": "^1.0.5",
+				"@sveltejs/acorn-typescript": "^1.0.9",
 				"@types/cookie": "^0.6.0",
-				"acorn": "^8.14.1",
+				"acorn": "^8.16.0",
 				"cookie": "^0.6.0",
-				"devalue": "^5.6.4",
+				"devalue": "^5.8.1",
 				"esm-env": "^1.2.2",
 				"kleur": "^4.1.5",
 				"magic-string": "^0.30.5",
@@ -1272,7 +1272,7 @@
 				"@opentelemetry/api": "^1.0.0",
 				"@sveltejs/vite-plugin-svelte": "^3.0.0 || ^4.0.0-next.1 || ^5.0.0 || ^6.0.0-next.0 || ^7.0.0",
 				"svelte": "^4.0.0 || ^5.0.0-next.0",
-				"typescript": "^5.3.3",
+				"typescript": "^5.3.3 || ^6.0.0",
 				"vite": "^5.0.3 || ^6.0.0 || ^7.0.0-beta.0 || ^8.0.0"
 			},
 			"peerDependenciesMeta": {
@@ -1685,19 +1685,6 @@
 			"integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
 			"license": "MIT"
 		},
-		"node_modules/@typescript-eslint/types": {
-			"version": "8.58.0",
-			"resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.58.0.tgz",
-			"integrity": "sha512-O9CjxypDT89fbHxRfETNoAnHj/i6IpRK0CvbVN3qibxlLdo5p5hcLmUuCCrHMpxiWSwKyI8mCP7qRNYuOJ0Uww==",
-			"license": "MIT",
-			"engines": {
-				"node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-			},
-			"funding": {
-				"type": "opencollective",
-				"url": "https://opencollective.com/typescript-eslint"
-			}
-		},
 		"node_modules/@vitest/expect": {
 			"version": "4.1.9",
 			"resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.9.tgz",
@@ -2057,9 +2044,9 @@
 			}
 		},
 		"node_modules/devalue": {
-			"version": "5.6.4",
-			"resolved": "https://registry.npmjs.org/devalue/-/devalue-5.6.4.tgz",
-			"integrity": "sha512-Gp6rDldRsFh/7XuouDbxMH3Mx8GMCcgzIb1pDTvNyn8pZGQ22u+Wa+lGV9dQCltFQ7uVw0MhRyb8XDskNFOReA==",
+			"version": "5.8.1",
+			"resolved": "https://registry.npmjs.org/devalue/-/devalue-5.8.1.tgz",
+			"integrity": "sha512-4CXDYRBGqN+57wVJkuXBYmpAVUSg3L6JAQa/DFqm238G73E1wuyc/JhGQJzN7vUf/CMphYau2zXbfWzDR5aTEw==",
 			"license": "MIT"
 		},
 		"node_modules/dijkstrajs": {
@@ -2109,9 +2096,9 @@
 			"license": "MIT"
 		},
 		"node_modules/esbuild": {
-			"version": "0.27.4",
-			"resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.4.tgz",
-			"integrity": "sha512-Rq4vbHnYkK5fws5NF7MYTU68FPRE1ajX7heQ/8QXXWqNgqqJ/GkmmyxIzUnf2Sr/bakf8l54716CcMGHYhMrrQ==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
+			"integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
 			"dev": true,
 			"hasInstallScript": true,
 			"license": "MIT",
@@ -2122,32 +2109,32 @@
 				"node": ">=18"
 			},
 			"optionalDependencies": {
-				"@esbuild/aix-ppc64": "0.27.4",
-				"@esbuild/android-arm": "0.27.4",
-				"@esbuild/android-arm64": "0.27.4",
-				"@esbuild/android-x64": "0.27.4",
-				"@esbuild/darwin-arm64": "0.27.4",
-				"@esbuild/darwin-x64": "0.27.4",
-				"@esbuild/freebsd-arm64": "0.27.4",
-				"@esbuild/freebsd-x64": "0.27.4",
-				"@esbuild/linux-arm": "0.27.4",
-				"@esbuild/linux-arm64": "0.27.4",
-				"@esbuild/linux-ia32": "0.27.4",
-				"@esbuild/linux-loong64": "0.27.4",
-				"@esbuild/linux-mips64el": "0.27.4",
-				"@esbuild/linux-ppc64": "0.27.4",
-				"@esbuild/linux-riscv64": "0.27.4",
-				"@esbuild/linux-s390x": "0.27.4",
-				"@esbuild/linux-x64": "0.27.4",
-				"@esbuild/netbsd-arm64": "0.27.4",
-				"@esbuild/netbsd-x64": "0.27.4",
-				"@esbuild/openbsd-arm64": "0.27.4",
-				"@esbuild/openbsd-x64": "0.27.4",
-				"@esbuild/openharmony-arm64": "0.27.4",
-				"@esbuild/sunos-x64": "0.27.4",
-				"@esbuild/win32-arm64": "0.27.4",
-				"@esbuild/win32-ia32": "0.27.4",
-				"@esbuild/win32-x64": "0.27.4"
+				"@esbuild/aix-ppc64": "0.28.1",
+				"@esbuild/android-arm": "0.28.1",
+				"@esbuild/android-arm64": "0.28.1",
+				"@esbuild/android-x64": "0.28.1",
+				"@esbuild/darwin-arm64": "0.28.1",
+				"@esbuild/darwin-x64": "0.28.1",
+				"@esbuild/freebsd-arm64": "0.28.1",
+				"@esbuild/freebsd-x64": "0.28.1",
+				"@esbuild/linux-arm": "0.28.1",
+				"@esbuild/linux-arm64": "0.28.1",
+				"@esbuild/linux-ia32": "0.28.1",
+				"@esbuild/linux-loong64": "0.28.1",
+				"@esbuild/linux-mips64el": "0.28.1",
+				"@esbuild/linux-ppc64": "0.28.1",
+				"@esbuild/linux-riscv64": "0.28.1",
+				"@esbuild/linux-s390x": "0.28.1",
+				"@esbuild/linux-x64": "0.28.1",
+				"@esbuild/netbsd-arm64": "0.28.1",
+				"@esbuild/netbsd-x64": "0.28.1",
+				"@esbuild/openbsd-arm64": "0.28.1",
+				"@esbuild/openbsd-x64": "0.28.1",
+				"@esbuild/openharmony-arm64": "0.28.1",
+				"@esbuild/sunos-x64": "0.28.1",
+				"@esbuild/win32-arm64": "0.28.1",
+				"@esbuild/win32-ia32": "0.28.1",
+				"@esbuild/win32-x64": "0.28.1"
 			}
 		},
 		"node_modules/esm-env": {
@@ -2157,13 +2144,20 @@
 			"license": "MIT"
 		},
 		"node_modules/esrap": {
-			"version": "2.2.4",
-			"resolved": "https://registry.npmjs.org/esrap/-/esrap-2.2.4.tgz",
-			"integrity": "sha512-suICpxAmZ9A8bzJjEl/+rLJiDKC0X4gYWUxT6URAWBLvlXmtbZd5ySMu/N2ZGEtMCAmflUDPSehrP9BQcsGcSg==",
+			"version": "2.2.13",
+			"resolved": "https://registry.npmjs.org/esrap/-/esrap-2.2.13.tgz",
+			"integrity": "sha512-m8jH5hZgJE2RRUK/jjkGPcJEDAV+dYnZYFkosQaPTcE+Yw4xynXHOo6FUdwaWBtdR3b1MMa7wEDTSHeR2VWsGA==",
 			"license": "MIT",
 			"dependencies": {
-				"@jridgewell/sourcemap-codec": "^1.4.15",
+				"@jridgewell/sourcemap-codec": "^1.4.15"
+			},
+			"peerDependencies": {
 				"@typescript-eslint/types": "^8.2.0"
+			},
+			"peerDependenciesMeta": {
+				"@typescript-eslint/types": {
+					"optional": true
+				}
 			}
 		},
 		"node_modules/estree-walker": {
@@ -2722,9 +2716,9 @@
 			}
 		},
 		"node_modules/nanoid": {
-			"version": "3.3.11",
-			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-			"integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+			"version": "3.3.15",
+			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz",
+			"integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==",
 			"dev": true,
 			"funding": [
 				{
@@ -2853,9 +2847,9 @@
 			}
 		},
 		"node_modules/postcss": {
-			"version": "8.5.8",
-			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.8.tgz",
-			"integrity": "sha512-OW/rX8O/jXnm82Ey1k44pObPtdblfiuWnrd8X7GJ7emImCOstunGbXUpp7HdBrFQX6rJzn3sPT397Wp5aCwCHg==",
+			"version": "8.5.16",
+			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz",
+			"integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==",
 			"dev": true,
 			"funding": [
 				{
@@ -2873,7 +2867,7 @@
 			],
 			"license": "MIT",
 			"dependencies": {
-				"nanoid": "^3.3.11",
+				"nanoid": "^3.3.12",
 				"picocolors": "^1.1.1",
 				"source-map-js": "^1.2.1"
 			},
@@ -3138,23 +3132,23 @@
 			}
 		},
 		"node_modules/svelte": {
-			"version": "5.55.1",
-			"resolved": "https://registry.npmjs.org/svelte/-/svelte-5.55.1.tgz",
-			"integrity": "sha512-QjvU7EFemf6mRzdMGlAFttMWtAAVXrax61SZYHdkD6yoVGQ89VeyKfZD4H1JrV1WLmJBxWhFch9H6ig/87VGjw==",
+			"version": "5.56.4",
+			"resolved": "https://registry.npmjs.org/svelte/-/svelte-5.56.4.tgz",
+			"integrity": "sha512-/d0QHehmRuJW8gVz395MTkPcPozxzdjBMBE8oEYGz8O3b9KTMzzQ9ZHJQLuFKOHOPQbU6kx/X4iid/EBBzH7iw==",
 			"license": "MIT",
 			"dependencies": {
 				"@jridgewell/remapping": "^2.3.4",
 				"@jridgewell/sourcemap-codec": "^1.5.0",
-				"@sveltejs/acorn-typescript": "^1.0.5",
+				"@sveltejs/acorn-typescript": "^1.0.10",
 				"@types/estree": "^1.0.5",
 				"@types/trusted-types": "^2.0.7",
 				"acorn": "^8.12.1",
 				"aria-query": "5.3.1",
 				"axobject-query": "^4.1.0",
 				"clsx": "^2.1.1",
-				"devalue": "^5.6.4",
+				"devalue": "^5.8.1",
 				"esm-env": "^1.2.1",
-				"esrap": "^2.2.4",
+				"esrap": "^2.2.12",
 				"is-reference": "^3.0.3",
 				"locate-character": "^3.0.0",
 				"magic-string": "^0.30.11",
@@ -3348,13 +3342,13 @@
 			"license": "MIT"
 		},
 		"node_modules/vite": {
-			"version": "7.3.1",
-			"resolved": "https://registry.npmjs.org/vite/-/vite-7.3.1.tgz",
-			"integrity": "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA==",
+			"version": "7.3.6",
+			"resolved": "https://registry.npmjs.org/vite/-/vite-7.3.6.tgz",
+			"integrity": "sha512-4XP60spRGjSZFf1qYH+dJIkK2znL3zQfl9KkOV9MkkRR/3Dls0dxaBsQPTloEc5BLXWPL9vsOxopxyKoMmDueg==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"esbuild": "^0.27.0",
+				"esbuild": "^0.27.0 || ^0.28.0",
 				"fdir": "^6.5.0",
 				"picomatch": "^4.0.3",
 				"postcss": "^8.5.6",
--- a/frontend/src/lib/data-mode-store.test.ts
+++ b/frontend/src/lib/data-mode-store.test.ts
@@ -3,8 +3,8 @@ import { pickMediaUrl } from './data-mode-store';

 const upload = {
  id: 'abc-123',
-  preview_url: '/media/previews/p.jpg',
-  thumbnail_url: '/media/thumbnails/t.jpg',
+  preview_url: '/api/v1/upload/abc-123/preview',
+  thumbnail_url: '/api/v1/upload/abc-123/thumbnail',
 };

 describe('pickMediaUrl', () => {
@@ -13,11 +13,13 @@ describe('pickMediaUrl', () => {
  });

  it('saver mode → preview_url when present', () => {
-    expect(pickMediaUrl('saver', upload)).toBe('/media/previews/p.jpg');
+    expect(pickMediaUrl('saver', upload)).toBe('/api/v1/upload/abc-123/preview');
  });

  it('saver mode → thumbnail_url when preview is null', () => {
-    expect(pickMediaUrl('saver', { ...upload, preview_url: null })).toBe('/media/thumbnails/t.jpg');
+    expect(pickMediaUrl('saver', { ...upload, preview_url: null })).toBe(
+      '/api/v1/upload/abc-123/thumbnail'
+    );
  });

  it('saver mode → original route when both preview and thumbnail are null', () => {