Fix version restore endpoint by passing fileId through route and client API

[Copilot]

Version restore was failing before controller execution because verifyFileAccess only accepts id|fileId, while restore exposed only :versionId. This change aligns restore routing with access middleware so restore requests authorize correctly and reach restoreVersion.

• API contract alignment (backend)

  • Updated restore route from:
    • POST /api/files/restore/:versionId
  • To:
    • POST /api/files/restore/:fileId/:versionId
  • Kept existing access/role middleware chain; now verifyFileAccess can resolve the target file.

• Client integration update (frontend)

  • Updated restoreVersion API helper signature to accept (fileId, versionId).
  • Updated VersionHistory restore action to pass current fileId with selected versionId.

• Documentation sync

  • Updated README endpoint table and version-history flow diagram to reflect the new restore route shape.

• Restore endpoint hardening

  • Added route-level rate limiting on restore to mitigate repeated restore abuse patterns.

// backend/routes/fileRoutes.js
router.post(
  '/restore/:fileId/:versionId',
  restoreVersionRateLimit,
  verifyFileAccess,
  checkRole('editor'),
  restoreVersion
);

// frontend/src/services/fileApi.js
export const restoreVersion = async (fileId, versionId) =>
  (await api.post(`/api/files/restore/${fileId}/${versionId}`)).data;

[alokkksharmaa]

@copilot resolve the merge conflicts in this pull request

[alokkksharmaa]

approve

[alokkksharmaa]

..

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved and finalized the merge conflicts in commit abdd27c.

[Copilot]

Pull request overview

This PR updates the documented restore-version API shape and adds a route-level rate limit to the backend restore endpoint, along with the required backend dependency updates.

Changes:

• Updated README and controller comment to reflect POST /api/files/restore/:fileId/:versionId.
• Added express-rate-limit-based throttling middleware to the restore route.
• Added express-rate-limit (and transitive ip-address) to backend dependencies/lockfile.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
Readme.md	Syncs API reference + flow diagram to the restore route shape with fileId and versionId.
backend/routes/fileRoutes.js	Adds route-level rate limiting middleware on restore requests.
backend/package.json	Adds express-rate-limit dependency.
backend/package-lock.json	Locks express-rate-limit and transitive dependency versions.
backend/controllers/versionController.js	Updates the route header comment for restore to include :fileId/:versionId.

Files not reviewed (1)

• backend/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.