Skip to content

Return 400 for malformed bulk status JSON #461

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ralyodio merged 1 commit into from
Jun 14, 2026
Merged

Return 400 for malformed bulk status JSON #461

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions src/app/api/applications/bulk-status/route.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
import { describe, expect, it, vi, beforeEach } from "vitest";
import { NextRequest } from "next/server";
import { PUT } from "./route";

const mockGetAuthContext = vi.fn();
vi.mock("@/lib/auth/get-user", () => ({
getAuthContext: (...args: unknown[]) => mockGetAuthContext(...args),
}));

const mockFrom = vi.fn();

@greptile-apps greptile-apps Bot Jun 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 mockFrom is declared but never given a return value

mockFrom is asserted to not be called in the malformed-JSON test, which is correct. However, vi.fn() returns undefined by default, so any future test case in this file that exercises the happy path will get an immediate crash when the route calls supabase.from(...).select(...). Consider adding a minimal chain stub (e.g., .mockReturnValue({ select: vi.fn(), in: vi.fn(), ... })) in beforeEach so the fixture is ready for follow-on tests.

function makeRequest(body: string) {
return new NextRequest("http://localhost/api/applications/bulk-status", {
method: "PUT",
headers: { "Content-Type": "application/json" },
body,
});
}

describe("PUT /api/applications/bulk-status", () => {
beforeEach(() => {
vi.clearAllMocks();
mockGetAuthContext.mockResolvedValue({
user: { id: "poster-1" },
supabase: { from: mockFrom },
});
});

it("returns 400 for malformed JSON without querying Supabase", async () => {
const res = await PUT(makeRequest("{"));

expect(res.status).toBe(400);
await expect(res.json()).resolves.toEqual({ error: "Invalid JSON body" });
expect(mockFrom).not.toHaveBeenCalled();
});
});
15 changes: 14 additions & 1 deletion src/app/api/applications/bulk-status/route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,16 @@ const bulkStatusSchema = z.object({
]),
});

async function parseJsonBody(request: NextRequest) {
try {
return { body: await request.json() };
} catch {
return {
response: NextResponse.json({ error: "Invalid JSON body" }, { status: 400 }),
};
}
}

// PUT /api/applications/bulk-status - Bulk update application statuses
export async function PUT(request: NextRequest) {
try {
Expand All @@ -22,7 +32,10 @@ export async function PUT(request: NextRequest) {
}
const { user, supabase } = auth;

const body = await request.json();
const parsed = await parseJsonBody(request);
if (parsed.response) return parsed.response;

const body = parsed.body;
Comment on lines +36 to +38

@greptile-apps greptile-apps Bot Jun 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Implicit discriminated-union access may obscure intent

parsed.response works at runtime because { body: any } never carries a response key, but TypeScript resolves this through an inferred union rather than an explicit discriminant — meaning future changes to parseJsonBody could silently break narrowing without a type error. Using 'response' in parsed as the guard makes the discriminant explicit and is also the idiomatic TypeScript way to narrow this union.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

const validationResult = bulkStatusSchema.safeParse(body);

if (!validationResult.success) {
Expand Down
Loading