From f1d6320dfef5a85d98c5d48c42ca2aeec1c1b647 Mon Sep 17 00:00:00 2001
From: Samu <me@samu.lol>
Date: Sat, 29 Aug 2026 17:30:02 +0200
Subject: [PATCH] fix: validate match album before discogs fetch, guard barcode
 type

---
 server/src/routes/collectionRoutes.ts | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/server/src/routes/collectionRoutes.ts b/server/src/routes/collectionRoutes.ts
index 5ac66ee..429ea8c 100644
--- a/server/src/routes/collectionRoutes.ts
+++ b/server/src/routes/collectionRoutes.ts
@@ -58,11 +58,21 @@ export async function registerCollectionRoutes(app: FastifyInstance): Promise<vo
     if (!client) return reply.code(409).send({ error: 'no_discogs_token' })
     const { releaseId, barcode, matchAlbumId } = (request.body ?? {}) as {
       releaseId?: number
-      barcode?: string
+      barcode?: unknown
       matchAlbumId?: number
     }
     if (typeof releaseId !== 'number') return reply.code(400).send({ error: 'invalid_input' })
 
+    const db = request.server.db
+    const userId = request.user!.id
+
+    if (matchAlbumId != null) {
+      const album = db
+        .prepare('SELECT id FROM digital_albums WHERE id = ? AND user_id = ?')
+        .get(matchAlbumId, userId)
+      if (!album) return reply.code(404).send({ error: 'album_not_found' })
+    }
+
     let release
     try {
       release = await client.getRelease(releaseId)
@@ -71,12 +81,11 @@ export async function registerCollectionRoutes(app: FastifyInstance): Promise<vo
       return reply.code(code).send(body)
     }
 
-    const db = request.server.db
-    const userId = request.user!.id
+    const barcodeStr = typeof barcode === 'string' ? barcode : undefined
     const artworkFile = release.coverUrl
       ? await cacheArtwork(request.server.config.artworkDir, release.coverUrl, request.server.fetchImpl)
       : null
-    const barcodes = barcode && !release.barcodes.includes(barcode) ? [...release.barcodes, barcode] : release.barcodes
+    const barcodes = barcodeStr && !release.barcodes.includes(barcodeStr) ? [...release.barcodes, barcodeStr] : release.barcodes
 
     let itemId: number
     try {
@@ -111,10 +120,6 @@ export async function registerCollectionRoutes(app: FastifyInstance): Promise<vo
     }
 
     if (matchAlbumId != null) {
-      const album = db
-        .prepare('SELECT id FROM digital_albums WHERE id = ? AND user_id = ?')
-        .get(matchAlbumId, userId)
-      if (!album) return reply.code(404).send({ error: 'album_not_found' })
       db.prepare('INSERT INTO match_links (user_id, item_id, album_id) VALUES (?, ?, ?)').run(
         userId,
         itemId,