BUG: `GET /assets/:id/live-path` uses asset `display_name` to find recorder — will match wrong recorder #76

New issue

Closed

opened 2026-05-25 06:26:12 -04:00 by zgaetano · 0 comments

zgaetano commented

2026-05-25 06:26:12 -04:00

Owner

Bug

GET /api/v1/assets/:id/live-path at services/mam-api/src/routes/assets.js:312-316:

const rec = await pool.query(
  `SELECT recording_container FROM recorders
   WHERE current_session_id = $1
   ORDER BY updated_at DESC LIMIT 1`,
  [asset.display_name]
);

The current_session_id column is set to clipName (a human-readable string like "MyRecorder_20260524_235959"). But the query joins on asset.display_name which could be:

The auto-generated clip name (matches current_session_id) — or
A manually renamed display name (PATCH /assets/:id with display_name)

Impact

If an editor renames an asset, the live-path lookup will either:

Find no recorder match (returns recording_container as mov default) — minor
Find a different recorder whose current_session_id happens to match the renamed asset — this would return the wrong extension for the live path

Location

services/mam-api/src/routes/assets.js:312-316

Fix

Query by asset ID directly instead of by display_name matching current_session_id. The recorder's session should track the asset UUID, not the human-readable clip name.

## Bug `GET /api/v1/assets/:id/live-path` at `services/mam-api/src/routes/assets.js:312-316`: ```js const rec = await pool.query( `SELECT recording_container FROM recorders WHERE current_session_id = $1 ORDER BY updated_at DESC LIMIT 1`, [asset.display_name] ); ``` The `current_session_id` column is set to `clipName` (a human-readable string like `"MyRecorder_20260524_235959"`). But the query joins on `asset.display_name` which could be: - The auto-generated clip name (matches `current_session_id`) — **or** - A manually renamed display name (PATCH /assets/:id with `display_name`) ## Impact If an editor renames an asset, the live-path lookup will either: 1. Find no recorder match (returns `recording_container` as `mov` default) — minor 2. Find a **different** recorder whose `current_session_id` happens to match the renamed asset — this would return the wrong extension for the live path ## Location `services/mam-api/src/routes/assets.js:312-316` ## Fix Query by asset ID directly instead of by `display_name` matching `current_session_id`. The recorder's session should track the asset UUID, not the human-readable clip name.