Fix photo and timeline submission bulletproofing

Implement rate limiting, validation, retry logic, and ban checking for photo and timeline submissions. This includes updates to `UppyPhotoSubmissionUpload.tsx` and `entitySubmissionHelpers.ts`.

src/components/upload/UppyPhotoSubmissionUpload.tsx

@@ -18,6 +18,9 @@ import { Camera, CheckCircle, AlertCircle, Info } from "lucide-react";
 import { UppyPhotoSubmissionUploadProps } from "@/types/submissions";
 import { withRetry } from "@/lib/retryHelpers";
 import { logger } from "@/lib/logger";
+import { breadcrumb } from "@/lib/errorBreadcrumbs";
+import { checkSubmissionRateLimit, recordSubmissionAttempt } from "@/lib/submissionRateLimiter";
+import { sanitizeErrorMessage } from "@/lib/errorSanitizer";
 
 export function UppyPhotoSubmissionUpload({
   onSubmissionComplete,
@@ -81,6 +84,54 @@ export function UppyPhotoSubmissionUpload({
     setIsSubmitting(true);
 
     try {
+      // ✅ Phase 4: Rate limiting check
+      const rateLimit = checkSubmissionRateLimit(user.id);
+      if (!rateLimit.allowed) {
+        const sanitizedMessage = sanitizeErrorMessage(rateLimit.reason || 'Rate limit exceeded');
+        logger.warn('[RateLimit] Photo submission blocked', {
+          userId: user.id,
+          reason: rateLimit.reason
+        });
+        throw new Error(sanitizedMessage);
+      }
+      recordSubmissionAttempt(user.id);
+
+      // ✅ Phase 4: Breadcrumb tracking
+      breadcrumb.userAction('Start photo submission', 'handleSubmit', {
+        photoCount: photos.length,
+        entityType,
+        entityId,
+        userId: user.id
+      });
+
+      // ✅ Phase 4: Ban check with retry
+      breadcrumb.apiCall('profiles', 'SELECT');
+      const profile = await withRetry(
+        async () => {
+          const { data, error } = await supabase
+            .from('profiles')
+            .select('banned')
+            .eq('user_id', user.id)
+            .single();
+          
+          if (error) throw error;
+          return data;
+        },
+        { maxAttempts: 2 }
+      );
+
+      if (profile?.banned) {
+        throw new Error('Account suspended. Contact support for assistance.');
+      }
+
+      // ✅ Phase 4: Validate photos before processing
+      if (photos.some(p => !p.file)) {
+        throw new Error('All photos must have valid files');
+      }
+
+      breadcrumb.userAction('Upload images', 'handleSubmit', {
+        totalImages: photos.length
+      });
       // Upload all photos that haven't been uploaded yet
       const uploadedPhotos: PhotoWithCaption[] = [];
       const photosToUpload = photos.filter((p) => p.file);
@@ -213,7 +264,24 @@ export function UppyPhotoSubmissionUpload({
 
       setUploadProgress(null);
 
+      // ✅ Phase 4: Validate uploaded photos before DB insertion
+      breadcrumb.userAction('Validate photos', 'handleSubmit', {
+        uploadedCount: uploadedPhotos.length
+      });
+
+      const allPhotos = [...uploadedPhotos, ...photos.filter(p => !p.file)];
+      
+      allPhotos.forEach((photo, index) => {
+        if (!photo.url) {
+          throw new Error(`Photo ${index + 1}: Missing URL`);
+        }
+        if (photo.uploadStatus === 'uploaded' && !photo.url.includes('/images/')) {
+          throw new Error(`Photo ${index + 1}: Invalid Cloudflare URL format`);
+        }
+      });
+
       // Create submission records with retry logic
+      breadcrumb.apiCall('create_submission_with_items', 'RPC');
       await withRetry(
         async () => {
           // Create content_submission record first

src/lib/entitySubmissionHelpers.ts

@@ -2463,13 +2463,61 @@ export async function submitTimelineEvent(
   data: TimelineEventFormData,
   userId: string
 ): Promise<{ submitted: boolean; submissionId: string }> {
-  // Validate user
+  // ✅ Phase 4: Validate user
   if (!userId) {
     throw new Error('User ID is required for timeline event submission');
   }
 
-  // Create the main submission record
-  const { data: submissionData, error: submissionError } = await supabase
+  // ✅ Phase 4: Rate limiting check
+  checkRateLimitOrThrow(userId, 'timeline_event_creation');
+  recordSubmissionAttempt(userId);
+
+  // ✅ Phase 4: Validation
+  if (!data.title?.trim()) {
+    throw new Error('Timeline event title is required');
+  }
+  if (!data.event_date) {
+    throw new Error('Timeline event date is required');
+  }
+  if (!data.event_type) {
+    throw new Error('Timeline event type is required');
+  }
+
+  // ✅ Phase 4: Breadcrumb tracking
+  breadcrumb.userAction('Start timeline event submission', 'submitTimelineEvent', {
+    entityType,
+    entityId,
+    eventType: data.event_type,
+    userId
+  });
+
+  // ✅ Phase 4: Ban check with retry
+  breadcrumb.apiCall('profiles', 'SELECT');
+  const { withRetry } = await import('./retryHelpers');
+  
+  const profile = await withRetry(
+    async () => {
+      const { data, error } = await supabase
+        .from('profiles')
+        .select('banned')
+        .eq('user_id', userId)
+        .single();
+      
+      if (error) throw error;
+      return data;
+    },
+    { maxAttempts: 2 }
+  );
+
+  if (profile?.banned) {
+    throw new Error('Account suspended. Contact support for assistance.');
+  }
+
+  // ✅ Phase 4: Create submission with retry logic
+  breadcrumb.apiCall('content_submissions', 'INSERT');
+  const submissionData = await withRetry(
+    async () => {
+      const { data, error } = await supabase
         .from('content_submissions')
         .insert({
           user_id: userId,
@@ -2479,16 +2527,28 @@ export async function submitTimelineEvent(
         .select('id')
         .single();
 
-  if (submissionError) {
-    handleError(submissionError, {
-      action: 'Submit timeline event',
-      userId,
-    });
-    throw new Error('Failed to create timeline event submission');
-  }
+      if (error) throw error;
+      if (!data) throw new Error('Failed to create timeline event submission');
       
-  // ✅ FIXED: Insert into timeline_event_submissions table (relational pattern)
-  const { data: timelineSubmission, error: timelineSubmissionError } = await supabase
+      return data;
+    },
+    {
+      onRetry: (attempt, error, delay) => {
+        logger.warn('Retrying timeline event submission creation', { 
+          attempt, 
+          delay,
+          userId,
+          eventType: data.event_type 
+        });
+      }
+    }
+  );
+
+  // ✅ Phase 4: Insert timeline_event_submission with retry
+  breadcrumb.apiCall('timeline_event_submissions', 'INSERT');
+  const timelineSubmission = await withRetry(
+    async () => {
+      const { data: insertedData, error } = await supabase
         .from('timeline_event_submissions')
         .insert({
           submission_id: submissionData.id,
@@ -2510,16 +2570,27 @@ export async function submitTimelineEvent(
         .select('id')
         .single();
 
-  if (timelineSubmissionError) {
-    handleError(timelineSubmissionError, {
-      action: 'Submit timeline event data',
-      userId,
-    });
-    throw new Error('Failed to submit timeline event for review');
-  }
+      if (error) throw error;
+      if (!insertedData) throw new Error('Failed to submit timeline event for review');
       
-  // ✅ Create submission_items referencing timeline_event_submission (no JSON data)
-  const { error: itemError } = await supabase
+      return insertedData;
+    },
+    {
+      onRetry: (attempt, error, delay) => {
+        logger.warn('Retrying timeline event data insertion', { 
+          attempt, 
+          delay,
+          submissionId: submissionData.id 
+        });
+      }
+    }
+  );
+
+  // ✅ Phase 4: Create submission_items with retry
+  breadcrumb.apiCall('submission_items', 'INSERT');
+  await withRetry(
+    async () => {
+      const { error } = await supabase
         .from('submission_items')
         .insert({
           submission_id: submissionData.id,
@@ -2534,13 +2605,18 @@ export async function submitTimelineEvent(
           timeline_event_submission_id: timelineSubmission.id
         });
 
-  if (itemError) {
-    handleError(itemError, {
-      action: 'Create timeline event submission item',
-      userId,
+      if (error) throw error;
+    },
+    {
+      onRetry: (attempt, error, delay) => {
+        logger.warn('Retrying timeline event submission item creation', { 
+          attempt, 
+          delay,
+          submissionId: submissionData.id 
         });
-    throw new Error('Failed to link timeline event submission');
       }
+    }
+  );
 
   return {
     submitted: true,
@@ -2563,22 +2639,77 @@ export async function submitTimelineEventUpdate(
   data: TimelineEventFormData,
   userId: string
 ): Promise<{ submitted: boolean; submissionId: string }> {
-  // Fetch original event
-  const { data: originalEvent, error: fetchError } = await supabase
+  // ✅ Phase 4: Validate user
+  if (!userId) {
+    throw new Error('User ID is required for timeline event update');
+  }
+
+  // ✅ Phase 4: Rate limiting check
+  checkRateLimitOrThrow(userId, 'timeline_event_update');
+  recordSubmissionAttempt(userId);
+
+  // ✅ Phase 4: Validation
+  if (!data.title?.trim()) {
+    throw new Error('Timeline event title is required');
+  }
+  if (!data.event_date) {
+    throw new Error('Timeline event date is required');
+  }
+
+  // ✅ Phase 4: Breadcrumb tracking
+  breadcrumb.userAction('Start timeline event update', 'submitTimelineEventUpdate', {
+    eventId,
+    userId
+  });
+
+  // ✅ Phase 4: Ban check with retry
+  const { withRetry } = await import('./retryHelpers');
+  
+  breadcrumb.apiCall('profiles', 'SELECT');
+  const profile = await withRetry(
+    async () => {
+      const { data, error } = await supabase
+        .from('profiles')
+        .select('banned')
+        .eq('user_id', userId)
+        .single();
+      
+      if (error) throw error;
+      return data;
+    },
+    { maxAttempts: 2 }
+  );
+
+  if (profile?.banned) {
+    throw new Error('Account suspended. Contact support for assistance.');
+  }
+
+  // Fetch original event with retry
+  breadcrumb.apiCall('entity_timeline_events', 'SELECT');
+  const originalEvent = await withRetry(
+    async () => {
+      const { data, error } = await supabase
         .from('entity_timeline_events')
         .select('*')
         .eq('id', eventId)
         .single();
 
-  if (fetchError || !originalEvent) {
-    throw new Error('Failed to fetch original timeline event');
-  }
+      if (error) throw error;
+      if (!data) throw new Error('Failed to fetch original timeline event');
+      
+      return data;
+    },
+    { maxAttempts: 2 }
+  );
 
   // Extract only changed fields from form data
   const changedFields = extractChangedFields(data, originalEvent as Partial<Record<string, unknown>>);
 
-  // Create the main submission record
-  const { data: submissionData, error: submissionError } = await supabase
+  // ✅ Phase 4: Create submission with retry
+  breadcrumb.apiCall('content_submissions', 'INSERT');
+  const submissionData = await withRetry(
+    async () => {
+      const { data, error } = await supabase
         .from('content_submissions')
         .insert({
           user_id: userId,
@@ -2588,16 +2719,28 @@ export async function submitTimelineEventUpdate(
         .select('id')
         .single();
 
-  if (submissionError) {
-    handleError(submissionError, {
-      action: 'Update timeline event',
-      metadata: { eventId },
-    });
-    throw new Error('Failed to create timeline event update submission');
-  }
+      if (error) throw error;
+      if (!data) throw new Error('Failed to create timeline event update submission');
       
-  // ✅ FIXED: Insert into timeline_event_submissions table (relational pattern)
-  const { data: timelineSubmission, error: timelineSubmissionError } = await supabase
+      return data;
+    },
+    {
+      onRetry: (attempt, error, delay) => {
+        logger.warn('Retrying timeline event update submission', { 
+          attempt, 
+          delay,
+          eventId,
+          userId 
+        });
+      }
+    }
+  );
+
+  // ✅ Phase 4: Insert timeline_event_submission with retry
+  breadcrumb.apiCall('timeline_event_submissions', 'INSERT');
+  const timelineSubmission = await withRetry(
+    async () => {
+      const { data: insertedData, error } = await supabase
         .from('timeline_event_submissions')
         .insert({
           submission_id: submissionData.id,
@@ -2619,16 +2762,28 @@ export async function submitTimelineEventUpdate(
         .select('id')
         .single();
 
-  if (timelineSubmissionError) {
-    handleError(timelineSubmissionError, {
-      action: 'Update timeline event data',
-      metadata: { eventId },
-    });
-    throw new Error('Failed to submit timeline event update');
-  }
+      if (error) throw error;
+      if (!insertedData) throw new Error('Failed to submit timeline event update');
       
-  // ✅ Create submission_items referencing timeline_event_submission (no JSON data)
-  const { error: itemError } = await supabase
+      return insertedData;
+    },
+    {
+      onRetry: (attempt, error, delay) => {
+        logger.warn('Retrying timeline event update data insertion', { 
+          attempt, 
+          delay,
+          eventId,
+          submissionId: submissionData.id 
+        });
+      }
+    }
+  );
+
+  // ✅ Phase 4: Create submission_items with retry
+  breadcrumb.apiCall('submission_items', 'INSERT');
+  await withRetry(
+    async () => {
+      const { error } = await supabase
         .from('submission_items')
         .insert({
           submission_id: submissionData.id,
@@ -2645,13 +2800,24 @@ export async function submitTimelineEventUpdate(
           timeline_event_submission_id: timelineSubmission.id
         });
 
-  if (itemError) {
-    handleError(itemError, {
-      action: 'Create timeline event update submission item',
-      metadata: { eventId },
+      if (error) throw error;
+    },
+    {
+      onRetry: (attempt, error, delay) => {
+        logger.warn('Retrying timeline event update item creation', { 
+          attempt, 
+          delay,
+          eventId,
+          submissionId: submissionData.id 
         });
-    throw new Error('Failed to link timeline event update submission');
       }
+    }
+  );
+
+  breadcrumb.userAction('Timeline event update submitted', 'submitTimelineEventUpdate', {
+    eventId,
+    submissionId: submissionData.id
+  });
 
   return {
     submitted: true,