Telegram (ask questions / claim the issue here first): https://t.me/+DOylgFv1jyJlNzM0
Labels: good first issue, backend
getUser in backend/src/controllers/user.controller.ts takes req.params.publicKey and hands it straight to prisma.user.findUnique with no validation.
getUserEvents in the same file already guards its param (if (typeof publicKey !== 'string')), and registerUserSchema validates the Stellar key format (/^G[A-Z2-7]{55}$/). getUser should do the same so a malformed key returns a clean 400 instead of an empty 404 or a wasted DB hit on garbage input.
What the fix has to hold to
- Missing/non-string
publicKey returns 400, not 404
- Match the validation style already used elsewhere in this file
Done when
Where to start
Just getUser in backend/src/controllers/user.controller.ts. Address validation for stream endpoints is out of scope (see #379). Tiny change.
Labels:
good first issue,backendgetUserinbackend/src/controllers/user.controller.tstakesreq.params.publicKeyand hands it straight toprisma.user.findUniquewith no validation.getUserEventsin the same file already guards its param (if (typeof publicKey !== 'string')), andregisterUserSchemavalidates the Stellar key format (/^G[A-Z2-7]{55}$/).getUsershould do the same so a malformed key returns a clean 400 instead of an empty 404 or a wasted DB hit on garbage input.What the fix has to hold to
publicKeyreturns 400, not 404Done when
publicKeyrejected with 400StrKey.isValidEd25519PublicKeyand 400 on bad formatWhere to start
Just
getUserinbackend/src/controllers/user.controller.ts. Address validation for stream endpoints is out of scope (see #379). Tiny change.