In `@backend/docs/swagger.json`:
- Around line 1252-1374: The Swagger spec for the createPitch endpoint is
documenting a 403 Forbidden but tests and controller behavior return 404 for
non-members; update the API documentation to match runtime behavior by changing
the controller's Swagger annotation (the createPitch endpoint's `@Failure` 403
entry) to `@Failure` 404 and update the generated swagger.json responses for
operationId "createPitch" (POST /api/v1/trips/{tripID}/pitches) to remove or
replace the 403 response with a 404 response (ensure the 404 uses errs.APIError
or the appropriate schema), and scan other pitch endpoints for similar
mismatches between `@Failure` annotations and actual status codes.

In `@backend/internal/controllers/pitches.go`:
- Around line 89-109: ListPitches (and the other controllers GetByID, Update,
Delete) never extract the caller userID from c.Locals("userID") nor pass it to
the service, so membership checks (like membershipRepo.IsMember used by Create)
cannot run; modify each controller (ListPitches, GetByID, Update, Delete) to
read userID := c.Locals("userID") (validate/convert as needed), pass that userID
into the corresponding pitchService methods (e.g., pitchService.List now accepts
userID), and update the service implementations to call
membershipRepo.IsMember(userID, tripID) before performing the operation,
returning a proper authorization error when not a member.

In `@backend/internal/migrations/20260205120000_create_trip_pitches.sql`:
- Around line 35-43: The down migration unconditionally drops the shared
function update_updated_at_column(), which may be used by other tables; instead,
make the function table-specific (e.g., update_trip_pitches_updated_at) and
update both the CREATE FUNCTION and CREATE TRIGGER statements in this migration
to use that name, then change the Down block to DROP TRIGGER IF EXISTS
update_trip_pitches_updated_at ON trip_pitches; and DROP FUNCTION IF EXISTS
update_trip_pitches_updated_at(); so only the per-table trigger function is
removed; ensure any references in this file to update_updated_at_column() are
replaced with the new per-table function name.
- Around line 22-28: The migration defines a shared function
update_updated_at_column() used by multiple migrations which causes
cross-migration breakage; rename the function to a table-specific name (e.g.,
update_trip_pitches_updated_at_column()) and update the trigger definition(s) in
this migration to call the new function name, and change the down migration to
DROP FUNCTION IF EXISTS update_trip_pitches_updated_at_column(); so this
migration creates, uses, and drops its own uniquely named function without
affecting other tables' triggers.

In `@backend/internal/models/pitches.go`:
- Around line 23-27: The ContentType field on CreatePitchRequest is currently
unrestricted and must be limited to an allowlist of audio MIME types; update
validation for CreatePitchRequest.ContentType to only accept known audio MIME
types (e.g., audio/mpeg, audio/mp3, audio/wav, audio/x-wav, audio/ogg,
audio/webm, audio/aac, audio/flac) either by replacing the struct tag with a
validate:"required,oneof=..." list or by adding a dedicated validator (register
a custom "audio" validator) that checks against a central audioMIMETypes
allowlist constant and then use validate:"required,audio" on ContentType; ensure
the validator is registered where request validation is wired so
CreatePitchRequest is rejected if ContentType is not in the allowlist (reference
CreatePitchRequest.ContentType and extensionFromContentType() for context).

In `@backend/internal/repository/pitches.go`:
- Around line 76-109: The Update method can build an invalid SQL when no fields
on UpdatePitchRequest are set; add a guard at the start of
pitchRepository.Update to detect when req.Title, req.Description and
req.Duration are all nil and return early with a clear error (e.g.,
errs.ErrBadRequest or a new validation error) instead of proceeding to
r.db.NewUpdate/ upd.Exec; ensure the guard references Update,
UpdatePitchRequest, the upd variable (r.db.NewUpdate()) and returns before
attempting to execute the update so no empty SET clause is produced, then keep
the rest of the method as-is to fetch the TripPitch on success.

In `@backend/internal/server/routers/trips.go`:
- Around line 41-46: The UpdatePitch and DeletePitch handlers currently only
require TripMemberRequired and therefore allow any member to change any pitch;
mirror the CreatePitch pattern by extracting the authenticated userID in the
UpdatePitch and DeletePitch controller handlers and pass it into the pitch
service (e.g., call service.UpdatePitch(ctx, userID, tripID, pitchID, ... ) and
service.DeletePitch(ctx, userID, tripID, pitchID) or similar). In the service
(or repository) add an ownership check that loads the pitch owner (e.g.,
repo.GetPitchOwner or repo.GetPitchByID) and compares ownerID == userID,
returning a 403/permission error if they differ; only proceed to update/delete
when the user is the owner. Ensure errors are propagated back to the controller
to return the correct HTTP status.

In `@backend/internal/services/pitches.go`:
- Around line 61-104: The Create handler currently inserts the DB record via
s.pitchRepo.Create and only then calls s.presignClient.PresignPutObject, which
leaves an orphan pitch if presign fails; change the flow in Create to generate
the presigned upload URL first (call s.presignClient.PresignPutObject to get
presigned.URL and expires), then construct the models.TripPitch and call
s.pitchRepo.Create (or alternatively, if you prefer to keep the insert-first
pattern, call s.pitchRepo.Create and on any presign error call a delete/rollback
via s.pitchRepo.Delete to remove the created pitch); update code paths that
build apiPitch via pitchToAPIResponse to use the created pitch and return
UploadURL/ExpiresAt from the successful presign so no pitch exists without a
usable upload URL.
- Around line 143-151: The List loop is calling s.presignGetURL sequentially for
each pitch (items, s.presignGetURL, pitchToAPIResponse), causing latency at
scale; fix by not presigning in the list path—remove/omit audio_url from the
list response and change the list handler to call pitchToAPIResponse without
presigned URLs (or have pitchToAPIResponse accept a nil/empty audioURL), and
move presigning into the GetByID path where s.presignGetURL is invoked on
demand; alternatively, if audio_url must remain in List, parallelize presign
calls with a bounded worker pool (e.g., spawn N goroutines, use a jobs/results
channel and context cancellation) so s.presignGetURL calls run concurrently but
limited to a safe concurrency level.
- Around line 46-58: NewPitchService currently doesn't validate required config
fields which leads to nil-pointer panics; modify NewPitchService to validate
PitchServiceConfig.PresignClient, .PitchRepo, .MembershipRepo and .BucketName
(non-nil and non-empty for BucketName) and return a clear error for
missing/invalid values instead of constructing a service with nil
dependencies—this will require changing the constructor signature to return
(PitchServiceInterface, error) and returning a descriptive error for each
missing dependency (referencing NewPitchService, PitchServiceConfig, and the
PitchService struct/presignClient, pitchRepo, membershipRepo, bucketName
fields).
- Around line 184-186: The Delete method (PitchService.Delete) currently only
calls s.pitchRepo.Delete and leaves the S3 audio object orphaned; change it to
first load the pitch (e.g., via s.pitchRepo.Get or similar) to obtain the
AudioS3Key, then call the standard S3 client's DeleteObject for that key before
deleting the DB record (or delete DB record only after successful S3 deletion),
handling and returning errors appropriately; if the service only has a presign
client, add a standard S3 client to PitchServiceConfig and use it here, and
ensure you handle missing AudioS3Key gracefully to avoid panics.
- Around line 214-229: The function extensionFromContentType currently returns
"m4a" for any unrecognized MIME type; change its signature to return (string,
error) and make it explicitly validate against an allowlist of known audio MIME
types (e.g., "audio/m4a", "audio/mp4", "audio/mpeg", "audio/mp3", "audio/wav",
"audio/ogg", "audio/webm"); for matches return the proper extension, otherwise
return a non-nil error indicating unsupported content type. Update all callers
of extensionFromContentType to handle the error (propagate or reject the upload)
so invalid types like "application/pdf" no longer silently become .m4a. Ensure
error messages include the original contentType value for easier diagnosis.
- Around line 107-118: GetByID, List, Update, and Delete currently lack a userID
parameter and thus skip authorization: update the service method signatures for
GetByID, List, Update, and Delete to accept a userID (same type used by Create),
have the controller extract and pass the userID, and add authorization checks
inside each service method (for GetByID/List call trip membership verification
before calling pitchRepo.FindByIDAndTripID or the list repo method; for
Update/Delete verify that the user is either the pitch owner or a trip admin
before proceeding to modify/delete; for Update ensure ownership/admin check
precedes any update logic and for GetByID include the membership check before
presignGetURL and pitchToAPIResponse). Ensure existing helper methods such as
presignGetURL and pitchToAPIResponse are used only after authorization succeeds.

In `@backend/internal/tests/pitch_test.go`:
- Around line 304-340: TestPitchDelete is missing a case that verifies
non-members are rejected; add a subtest under TestPitchDelete that creates a
separate non-member user (e.g., nonMemberID via createTestUser), reuses
createPitch to create pitchID, then issues a DELETE request to
"/api/v1/trips/"+tripID+"/pitches/"+pitchID using testkit.Request with UserID
set to &nonMemberID and AssertStatus(http.StatusNotFound); this mirrors the
Create test pattern and ensures the delete endpoint is scoped to trip members.
- Around line 148-200: In TestPitchList's "returns pitches with audio_url"
subtest remove the redundant requireS3 call: the helper createPitch(t, app,
userID, tripID, "P1", "audio/mpeg") already invokes requireS3 internally, so
delete the extra requireS3(t) invocation to avoid reloading S3 configuration
unnecessarily and keep the rest of the subtest (the subsequent testkit request
and assertions) unchanged.

In `@frontend/api/trips/useGetAllTrips.ts`:
- Line 24: The request helper is dropping query params so pagination params
passed from useGetAllTrips (and other generated hooks) are never sent; add an
optional params property to the RequestConfig type (e.g., params?: Record<string
| number, any> | URLSearchParams) and update the request function to serialize
those params onto the fetch URL (e.g., append new
URLSearchParams(config.params).toString() to `${BASE_URL}${config.url}` only
when params exist), ensuring callers like useGetAllTrips.ts that pass params are
transmitted to the server.