Security: PATCH /whip and PATCH /whep stubs registered with empty schema — no AJV validation

Open Beginner friendly
#263 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
typescript
Domain
api, security

Research direction

Start with the PATCH handlers around lines 304–309 in src/api_whip.ts and 303–308 in src/api_whep.ts, and compare their route schemas with the OPTIONS stubs from issue #249. Add matching parameter validation to both routes, then verify that both PATCH stubs still return 405 while rejecting invalid path parameters and request bodies according to the schema.

Written by the indexing model from the issue text.

Description

Medium

Summary

The PATCH stubs on both the WHIP and WHEP routes are registered with an empty schema object (`{}`). Fastify/AJV cannot validate path parameters or the request body on these handlers.

Affected Files

  • `src/api_whip.ts` — `PATCH /whip/:productionId/:lineId` handler (~line 304–309)
  • `src/api_whep.ts` — `PATCH /whep/:productionId/:lineId` handler (~line 303–308)

Current State

```typescript
fastify.patch('/whip/:productionId/:lineId', { schema: {} }, async (request, reply) => {
reply.status(405).send();
});
```

The handlers only return 405 today, but the empty schema means:

  1. Path parameters (`productionId`, `lineId`) are not validated by AJV.
  2. Any request body passes through without schema enforcement.
  3. Inconsistent with every other route in the codebase that carries explicit TypeBox schemas.

Recommendation

Add a minimal TypeBox schema — at minimum a `params` declaration — consistent with how the OPTIONS stubs are handled (see issue #249):

```typescript
import { Type } from '@sinclair/typebox';

const WhipWhepParams = Type.Object({
productionId: Type.String({ minLength: 1, maxLength: 200 }),
lineId: Type.String({ minLength: 1, maxLength: 200 }),
});

fastify.patch(
'/whip/:productionId/:lineId',
{ schema: { params: WhipWhepParams, response: { 405: Type.Object({}) } } },
async (request, reply) => {
reply.status(405).send();
}
);
```

Apply the same fix to the WHEP PATCH stub.

Severity

Low — handlers always return 405; defence-in-depth concern and schema consistency.

Found by automated security audit 2026-07-06.

Dominant language
TypeScript
Stars
90
Forks
19
Avg merge
6d 9h
Merged PRs (30d)
35

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Eyevinn/intercom-manager

All issues in Eyevinn/intercom-manager

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.