From e61ef6c0caabf5adbcbdfe2313289114521f2760 Mon Sep 17 00:00:00 2001
From: VPS 4 Builder <deploy@clube67.com>
Date: Wed, 13 May 2026 23:20:39 +0200
Subject: [PATCH] fix(backend): move procedimentos/reorder before /:id to
 prevent route shadowing

Express matches routes in registration order. PUT /procedimentos/:id was
registered before /procedimentos/reorder, causing 'reorder' to be captured
as an id param and the reorder endpoint to be unreachable.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 backend/server.js | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/backend/server.js b/backend/server.js
index 5ed9eea..fad2f12 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -895,6 +895,20 @@ app.post('/api/procedimentos', async (req, res) => {
     }
 });
 
+app.put('/api/procedimentos/reorder', async (req, res) => {
+    const { orders } = req.body; // Array of {id, ordem}
+    try {
+        await withTransaction(async (client) => {
+            for (const item of orders) {
+                await client.query('UPDATE procedimentos SET ordem = $1 WHERE id = $2', [item.ordem, item.id]);
+            }
+        });
+        res.json({ success: true });
+    } catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+
 app.put('/api/procedimentos/:id', async (req, res) => {
     try {
         const { valoresPlanos, ...proc } = req.body;
@@ -917,20 +931,6 @@ app.put('/api/procedimentos/:id', async (req, res) => {
     }
 });
 
-app.put('/api/procedimentos/reorder', async (req, res) => {
-    const { orders } = req.body; // Array of {id, ordem}
-    try {
-        await withTransaction(async (client) => {
-            for (const item of orders) {
-                await client.query('UPDATE procedimentos SET ordem = $1 WHERE id = $2', [item.ordem, item.id]);
-            }
-        });
-        res.json({ success: true });
-    } catch (err) {
-        res.status(500).json({ error: err.message });
-    }
-});
-
 app.delete('/api/procedimentos/:id', async (req, res) => {
     try {
         await pool.query('DELETE FROM procedimentos WHERE id = $1', [req.params.id]);