Six defensive-check gaps in server/src/routes/admin.ts, all the same
theme (missing the same check a sibling endpoint already has):
1. PATCH /admin/api/drinks/:id with a taken name 500'd instead of 409 —
the bar-rename equivalent (and drink POST) already catch the UNIQUE
constraint, this endpoint didn't.
2. PATCH /admin/api/bars/:id with a nonexistent drink_id 500'd instead of
400 — drink_ids was only checked for integer-ness, not existence, so a
bogus id hit an uncaught FK-constraint error. Now validated against the
drinks table up front (rollback was already correct, this only fixes
the status code).
3. PATCH /admin/api/bars/:id on a nonexistent bar silently returned
200 {ok:true} — the drinks-PATCH equivalent checks info.changes === 0
and 404s, this endpoint checked nothing. Now 404s up front.
4. Non-string name in any of the four drink/bar POST/PATCH endpoints
500'd (object/numeric name hit an uncaught TypeError calling .trim()
on a non-string, or an uncaught SQLite type error). All four now
typeof-guard before use.
5. Drink names weren't trimmed or checked for emptiness, unlike bars —
an empty/whitespace name showed as a blank tablet tile, and a
trailing-space variant of an existing name bypassed the UNIQUE index
and split that drink's stats across two rows. Drink POST/PATCH now
trim + reject blank, matching bars.
Verified all six against a scratch DB with the real server running
end-to-end (login, each failure case, plus a same-request-shape sanity
check that valid updates still succeed). tsc --noEmit and the server
build both clean.
d6e9979439