mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 04:32:42 +00:00
Marc-André Bombeck
bb9bf0ba68
Four surfaces answered a bad request by quietly substituting a good one. Each fix comes with the test that catches it, and each test was confirmed red against the old behaviour before the fix went back in. `PATCH /api/user/ai-provider` inspected its body key by key with `typeof` guards, so a numeric `model` or a boolean `baseUrl` failed every guard, produced no entry in the update, and the write went ahead without it — a 200 that says "saved" for a field that was discarded. A body of nothing but such keys came back as "No valid fields" naming none of them. The real schema now lives in `src/lib/validations/ai-provider.ts`, the route runs one `safeParse`, and a mismatch is the multi-issue 422 every sibling answers with. The accepted field set is unchanged, and the object is deliberately not strict: an unknown key has always been ignored here and still is. The one thing the schema has to carry that no other does is that this body holds plaintext credentials, so no rule may interpolate the value it rejected — noted where the next `.refine()` would go. `?slice=` on `/api/analytics` was compared against one literal and fell through to the DEFAULT body on anything else, so `?slice=summary` answered 200 after running the heaviest chain on the surface. Invisible and expensive at once. Closed enum, 422 on anything outside it. `?metricType=` and `?limit=` on `/api/personal-records` were parsed defensively, which read as robustness and behaved as silence — and in one direction it was worse than silence: dropping an unrecognised `metricType` WIDENS the read to every metric, so a typo returned more of the record than was asked for. Both refuse now, and the 500 ceiling refuses rather than clamps, because serving a different number of rows than were requested is the same quiet substitution. No caller in the tree sends a value the new rules reject. `POST /api/ingest/medication` bucketed on the client address, so a household running a chat bridge, a button and a home-automation rule — the normal deployment for this route — put all three in one 60/min cell and let the chattiest starve the rest. It already resolves a per-caller identity two lines further down and threw it away; the bucket is that token now. A request that resolves no token keeps the per-IP bucket it always had, through the shared anonymous helper, so a flood is still capped and a broken proxy chain collapses into the tight global cell rather than a shared "unknown" one. Its 429 goes through `apiError` and carries `meta` like every other refusal. Two older tests pinned the defects by name — "drops an unknown metricType silently" and "falls back to default on garbage ?limit" — and one pinned a throw where the rest of the surface returns an envelope. All three are rewritten with the reason beside them. The generated YAML is deliberately not in this commit.
30 lines
1.1 KiB
TypeScript
30 lines
1.1 KiB
TypeScript
/**
|
|
* Query validation for `GET /api/analytics`.
|
|
*
|
|
* One parameter, one legal value, and the point of writing it down is that
|
|
* the route used to compare the raw string against `"summaries"` and fall
|
|
* through to the thick default body on anything else. `?slice=summary` then
|
|
* ran the whole 30-query chain and answered as if nothing were wrong, which
|
|
* is the most expensive way this surface can absorb a typo.
|
|
*
|
|
* Lives outside the route file so the OpenAPI registry can import it (a route
|
|
* module may only export handlers plus the Next.js route config).
|
|
*/
|
|
import { z } from "zod/v4";
|
|
|
|
/** The slices `GET /api/analytics` knows how to serve. */
|
|
export const ANALYTICS_SLICES = ["summaries"] as const;
|
|
|
|
export const analyticsSliceEnum = z.enum(ANALYTICS_SLICES);
|
|
|
|
export const analyticsQuerySchema = z.object({
|
|
/**
|
|
* `summaries` selects the slim tile-strip body. Omitted selects the thick
|
|
* default body. Any other value is refused — falling through to the
|
|
* default would hide the typo behind the more expensive read.
|
|
*/
|
|
slice: analyticsSliceEnum.optional(),
|
|
});
|
|
|
|
export type AnalyticsQuery = z.infer<typeof analyticsQuerySchema>;
|