[Bug]: PUT /api/profile has no Zod input validation — only mutation endpoint without validateBody()#839
Conversation
|
@KanishJebaMathewM I have submitted the fix. Please let me know if any changes are needed! |
|
🎉 Thank you for your contribution! Your pull request has been received and will be reviewed shortly. If you enjoy the project, please consider giving the repository a ⭐. You can also follow my GitHub profile to stay updated on future open-source projects. Thanks for being part of the community! 🚀 |
📝 WalkthroughWalkthroughA new Zod schema ChangesProfile Update Input Validation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~5 minutes Possibly related issues
Suggested labels
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/api/src/validation/requestSchemas.js`:
- Around line 137-142: The updateProfileSchema still accepts an empty object,
which lets empty profile updates reach the handler and fail as a server error.
Update the z.object definition for updateProfileSchema to require at least one
of the updatable fields so {} is rejected as a client-side validation error,
using the schema’s existing full_name, language, dark_mode, and is_online fields
as the reference point.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6d049270-d1c8-403e-bc82-fe0f30fa174f
📒 Files selected for processing (2)
backend/api/src/routes/profileRoutes.jsbackend/api/src/validation/requestSchemas.js
| export const updateProfileSchema = z.object({ | ||
| full_name: z.string().min(1, "Name is required").max(255, "Name is too long").optional(), | ||
| language: z.string().max(50, "Language is too long").optional(), | ||
| dark_mode: z.boolean().optional(), | ||
| is_online: z.boolean().optional(), | ||
| }).strict(); |
There was a problem hiding this comment.
🚀 Performance & Scalability | 🟡 Minor
🧩 Analysis chain
🌐 Web query:
What does Supabase supabase-js .update({}) with an empty object do — no-op or error?
💡 Result:
When using the Supabase JavaScript client (supabase-js), calling.update({}) with an empty object will generally result in a runtime error from the underlying database (PostgreSQL), not a no-op [1][2]. The update method expects an object containing the column names and values to be updated [3]. When an empty object is passed, the generated SQL statement typically attempts to perform an update without providing any SET clauses, which is syntactically invalid in SQL [1]. Specifically, the underlying postgrest-js library sends this request to the Supabase API (PostgREST), which will reject the invalid update request, returning an error [1][2]. For example, performing an update like: const { error } = await supabase.from('table_name').update({}).eq('id', 1); will cause the request to fail because the database cannot execute an UPDATE statement that does not specify any columns to modify. Therefore, you should always provide at least one valid column-value pair within the object to ensure the update operation is valid [3][2].
Citations:
- 1: TypeScript: insert()/update()/upsert() argument type too permissive supabase/supabase-js#1636
- 2: fix(postgrest): reject excess properties in insert, update, and upsert supabase/supabase-js#2186
- 3: https://supabase.com/docs/reference/javascript/update
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate the relevant files and show the surrounding code with line numbers.
git ls-files 'backend/api/src/validation/requestSchemas.js' 'backend/api/src/routes/profileRoutes.js'
echo '--- requestSchemas.js ---'
sed -n '120,170p' backend/api/src/validation/requestSchemas.js | cat -n
echo '--- profileRoutes.js ---'
sed -n '1,220p' backend/api/src/routes/profileRoutes.js | cat -nRepository: KanishJebaMathewM/Truxify
Length of output: 10140
Reject empty profile updates The schema still allows {}, and the handler turns that into an empty Supabase update, which fails and returns a 500 instead of a client error. Require at least one updatable field so empty requests are rejected with 400.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/api/src/validation/requestSchemas.js` around lines 137 - 142, The
updateProfileSchema still accepts an empty object, which lets empty profile
updates reach the handler and fail as a server error. Update the z.object
definition for updateProfileSchema to require at least one of the updatable
fields so {} is rejected as a client-side validation error, using the schema’s
existing full_name, language, dark_mode, and is_online fields as the reference
point.
KanishJebaMathewM
merged commit d84f78e
into
KanishJebaMathewM:main
|
🎉 Thank you for your contribution! Your pull request has been merged successfully. We appreciate your work and look forward to your future contributions. 🚀 |
2 participants
Fix
Added
updateProfileSchemaZod schema and appliedvalidateBody()middleware toPUT /api/profile, consistent with all other mutation endpoints.Changes
backend/api/src/validation/requestSchemas.js (lines 137-142)
updateProfileSchemawith validated fields:full_name,language,dark_mode,is_onlinebackend/api/src/routes/profileRoutes.js (line 11, 125)
validateBodyandupdateProfileSchemavalidateBody(updateProfileSchema)to the PUT route middleware chainCloses #740
Summary by CodeRabbit