[Bug]: Markers API silently drops notes and marker_type; update endpoint cannot change position

[jrsphoto]

Issue Category

Other

Bug Description

The Maps markers API endpoint (/api/maps/markers) silently drops two
fields on creation and update: notes and marker_type. The DB
schema and the MapMarker model include both fields, and they are
returned correctly by GET /api/maps/markers, but the VineJS
validators in admin/app/controllers/maps_controller.ts do not
whitelist them in either createMarker or updateMarker. Fields
sent in the request body are accepted with a 200 status, silently
discarded, and stored as null (or default).

Additionally, the updateMarker validator does not accept
latitude or longitude, so a marker's position cannot be changed
after creation via the API.

Related: the UI's marker popup also does not render the notes
field even when it has been set via direct DB manipulation, but that
is a separate front-end issue.

Steps to Reproduce

1. POST a marker with a notes field:

   curl -X POST http://:8080/api/maps/markers
   -H 'Content-Type: application/json'
   -H 'X-CSRF-TOKEN: '
   -d '{"name":"test","latitude":45,"longitude":-93,"color":"red","notes":"hello"}'

   Response: 200, but the returned marker object has no notes field.

2. Confirm persistence with GET /api/maps/markers: the newly created
   marker shows "notes": null.

3. Attempt to set notes via PATCH:

   curl -X PATCH http://:8080/api/maps/markers/
   -H 'Content-Type: application/json'
   -H 'X-CSRF-TOKEN: '
   -d '{"notes":"hello"}'

   Response: 200 with full marker object, but notes is still null.

4. Same behavior for marker_type. Tried alternate field names
   (note, description, comment, details, label, info,
   text, body) — all ignored.

5. PATCH also does not accept latitude/longitude, so markers
   cannot be repositioned via the API.

Expected Behavior

POST and PATCH on /api/maps/markers should accept notes and
marker_type fields per the existing DB schema and model. PATCH
should additionally accept latitude and longitude to allow
marker repositioning.

Actual Behavior

Requests succeed with HTTP 200, but notes, marker_type,
latitude, and longitude (on update) are silently dropped by the
VineJS validators in admin/app/controllers/maps_controller.ts
(methods createMarker and updateMarker). The fields never reach
the model or database.

Root cause is in the inline validator schemas. The create validator
only whitelists name, latitude, longitude, color. The update
validator only whitelists name and color. Adding the missing
fields to both schemas (and the corresponding model assignments)
resolves the issue.

N.O.M.A.D. Version

1.31.1

Operating System

Ubuntu 24.04

Docker Version

29.3.1

Do you have a dedicated GPU?

Yes

GPU Model (if applicable)

NVIDIA Gforce 3090TI

System Specifications

AMD 7950X3D
32GB
4tb nvme
2tb nvme
4tb SATA

Service Status (if relevant)

No response

Relevant Logs

Browser Console Errors (if UI issue)

Screenshots

No response

Additional Context

The fix is localized to admin/app/controllers/maps_controller.ts.
Both validators need additional fields added, and the corresponding
model assignments extended. I have a working patch and am happy to
submit a PR.

Specifically:

• createMarker: add notes and marker_type to the vine schema,
  and pass them through to MapMarker.create(...).
• updateMarker: add notes, marker_type, latitude, and
  longitude to the vine schema, and add matching
  if (payload.X !== undefined) marker.X = payload.X lines.

Optionally: add range validation on lat/lon (-90..90, -180..180).
Currently the create endpoint accepts any number.

Pre-submission Checklist

• I have searched for existing issues that might be related to this bug
• I am running the latest version of Project N.O.M.A.D. (or have noted my version above)
• I have redacted any personal or sensitive information from logs and screenshots
• This issue is NOT related to running N.O.M.A.D. on an unsupported/non-Debian-based OS

[jrsphoto]

I hope I did this correctly ;-)

[chriscrosstalk]

Thanks @jrsphoto — that's a beautiful bug report. Specific field-by-field repro, identified the exact validator schemas in maps_controller.ts, and proposed the fix including range validation. PR #770 is clean, small, and does what it says.

Your aside about the marker popup not rendering notes in the UI is a valid separate bug — want to file a second issue for the frontend piece (or I'm happy to open it and credit you)? Keeps the API fix and the UI fix independently reviewable.

Will close this out once #770 lands.

[jrsphoto]

if you don't mind opening the other bug report that would be ok. .