Fix version restore endpoint by passing fileId through route and client API

Readme.md

@@ -502,7 +502,7 @@ CodeSync/
 | `DELETE` | `/:id` | Delete file or folder (recursive) | Editor |
 | `POST` | `/:fileId/version` | Save version snapshot | Editor |
 | `GET` | `/:fileId/history` | Get version history | Viewer |
-| `POST` | `/restore/:versionId` | Restore a file version | Editor |
+| `POST` | `/restore/:fileId/:versionId` | Restore a file version | Editor |
 
 ---
 
@@ -666,7 +666,7 @@ Editor clicks "Save Version" icon
         │
         ▼
   User clicks "Restore" on a past version
-        │  POST /api/files/restore/:versionId
+        │  POST /api/files/restore/:fileId/:versionId
         ▼
   File.content overwritten with snapshot content
   (Socket will pick up and sync to all clients)
@@ -806,4 +806,3 @@ This project is licensed under the **MIT License** — see the [LICENSE](LICENSE
   <b>Built with ❤️ Alok Kumar Sharma</b>
 </p>
 
-

backend/controllers/versionController.js

@@ -40,7 +40,7 @@ export const getHistory = async (req, res) => {
   }
 };
 
-// ─── POST /api/files/restore/:versionId ──────────────────────────────────────
+// ─── POST /api/files/restore/:fileId/:versionId ──────────────────────────────
 export const restoreVersion = async (req, res) => {
   try {
     const { fileId, versionId } = req.params;

backend/package.json

@@ -14,6 +14,7 @@
     "cors": "^2.8.5",
     "dotenv": "^16.4.5",
     "express": "^4.18.2",
+    "express-rate-limit": "^8.5.2",
     "express-session": "^1.19.0",
     "jsonwebtoken": "^9.0.2",
     "mongodb": "^7.2.0",

backend/routes/fileRoutes.js

@@ -1,4 +1,5 @@
 import express from 'express';
+import rateLimit from 'express-rate-limit';
 import authMiddleware from '../middleware/authMiddleware.js';
 import { isEditor, requireRole, checkRole } from '../middleware/permissionMiddleware.js';
 import { verifyFileAccess } from '../middleware/filePermission.js';
@@ -16,6 +17,13 @@ import {
 } from '../controllers/versionController.js';
 
 const router = express.Router();
+const restoreVersionRateLimit = rateLimit({
+  windowMs: 60 * 1000,
+  max: 30,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { message: 'Too many requests. Please try again later.' }
+});
 
 router.use(authMiddleware);
 
@@ -38,6 +46,6 @@ router.delete('/:id', verifyFileAccess, checkRole('editor'), deleteFile);
 // Version history
 router.post('/:fileId/version', verifyFileAccess, checkRole('editor'), saveVersion);
 router.get('/:fileId/history', verifyFileAccess, getHistory);
-router.post('/restore/:fileId/:versionId', verifyFileAccess, checkRole('editor'), restoreVersion);
+router.post('/restore/:fileId/:versionId', restoreVersionRateLimit, verifyFileAccess, checkRole('editor'), restoreVersion);
 
 export default router;