Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Group and user routes return 500 for a malformed or unknown id instead of 400 or 404

Aperta
  • Qualcosa non va?
#1,759 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
api, backend-api-design, databases

Direzione di ricerca

Read apps/api/AGENTS.md (Validation), then inspect the named group and user controllers and services, the listed controllers with groupId filters, and packages/schemas/src/audit/audit.ts. Start with the existing ValidObjectIdPipe use in SubjectsController.findCustomIds and the lookup pattern in GroupsService.updateById; run the named service, integration, and authorization tests. Done means malformed IDs return 400 and missing or inaccessible records return 404 rather than 500.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Area: API Bug Difficulty: Low Good First Issue Priority: Low

The group and user routes return 500 for a bad or stale id, and log it as a server error. GroupsController and UsersController pass :id straight to Prisma, as do the groupId query parameters of the users, sessions, subjects and summary routes. These fields are @db.ObjectId, so a value that is not 24 hex characters makes Prisma throw a malformed-ObjectID PrismaClientKnownRequestError. Separately, the write handlers that call update or delete directly throw P2025 when no row matches. Neither error is an HttpException, so libnest's global filter answers 500 and logs it at error level. The same happens when a group manager's DELETE /v1/groups/<foreign group id> is refused. apps/api/AGENTS.md (Validation) says params and query strings must be validated explicitly, and SubjectsController.findCustomIds already uses ValidObjectIdPipe for this.

Where

apps/api/src/groups/groups.controller.ts:25-30, and the same @Param('id') id: string on the get and patch handlers:

@Delete(':id')
@RouteAccess({ action: 'delete', subject: 'Group' })
deleteById(@Param('id') id: string, @CurrentUser('ability') ability?: AppAbility) {
  return this.groupsService.deleteById(id, { ability });
}

apps/api/src/groups/groups.service.ts:54-58, which deletes without first checking that a row exists:

async deleteById(id: string, { ability }: EntityOperationOptions = {}) {
  return this.groupModel.delete({
    where: { AND: [accessibleQuery(ability, 'delete', 'Group')], id }
  });
}

The same pattern appears in:

  • apps/api/src/users/users.controller.ts:35-111: every :id handler.
  • apps/api/src/users/users.service.ts:37-43, :175-181 and :204-217: archiveById, unarchiveById and updateById call userModel.update directly.
  • Unvalidated groupId query parameters: users.controller.ts:77, sessions/sessions.controller.ts:28, subjects/subjects.controller.ts:32, summary/summary.controller.ts:22.
  • The audit log page's URL filters groupId and userId (packages/schemas/src/audit/audit.ts:31-32).

Reproduce

Verified with the api integration harness, signed in as admin:

  • GET /v1/groups/abc, PATCH /v1/groups/abc and GET /v1/users/abc return 500.
  • GET /v1/users?groupId=abc, GET /v1/sessions?groupId=abc, GET /v1/subjects?groupId=abc and GET /v1/summary?groupId=abc return 500.
  • DELETE /v1/groups/000000000000000000000000, PATCH /v1/users/000000000000000000000000 and PATCH /v1/users/000000000000000000000000/archive return 500.

Actual: 500 Internal Server Error, logged at error level.
Expected: 400 for a malformed id and 404 for an id that matches no row the caller can access. GET /v1/groups/<unknown but well-formed id> already returns 404.

Tests

  • apps/api/src/groups/__tests__/groups.service.test.ts: it('should throw NotFoundException when the group to delete does not exist or is not accessible, rather than a server error'), with matching cases in users.service.test.ts for archive, unarchive and update.
  • apps/api/test/suites/ (integration, which runs the real pipes): it('should answer 400 for a malformed group or user id, rather than a server error').
  • testing/src/specs/authorization.spec.ts: tighten 'should not let a group manager delete a group they do not belong to' to expect 404 instead of any non-OK status.

Suggested fix

Add ValidObjectIdPipe to every :id param in GroupsController and UsersController except self-update/:id, which already returns 403 before Prisma sees the id. Validate the groupId query parameters with new ParseSchemaPipe({ isOptional: true, schema }) using an ObjectId schema, and do the same for the audit query's groupId and userId. In GroupsService.deleteById and the three UsersService writes, look the row up first, as GroupsService.updateById does, and throw NotFoundException when it is missing.

Lingua principale
TypeScript
Stelle
119
Fork
19
Merge medio
18h 50m
PR unite (30g)
36

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di DouglasNeuroInformatics/OpenDataCapture

Tutte le issue di DouglasNeuroInformatics/OpenDataCapture

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.