samu/record-shop
1
0
Fork 0
Code Issues Activity

fix: validate match album before discogs fetch, guard barcode type

Browse Source
This commit is contained in:
Samuel
2026-08-29 17:30:02 +02:00
parent 566a9bfc0d
commit f1d6320dfe
1 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
server/src/routes/collectionRoutes.ts
View File

@@ -58,11 +58,21 @@ export async function registerCollectionRoutes(app: FastifyInstance): Promise<vo
if (!client) return reply.code(409).send({ error: 'no_discogs_token' }) if (!client) return reply.code(409).send({ error: 'no_discogs_token' })
const { releaseId, barcode, matchAlbumId } = (request.body ?? {}) as { const { releaseId, barcode, matchAlbumId } = (request.body ?? {}) as {
releaseId?: number releaseId?: number
barcode?: string barcode?: unknown
matchAlbumId?: number matchAlbumId?: number
} }
if (typeof releaseId !== 'number') return reply.code(400).send({ error: 'invalid_input' }) if (typeof releaseId !== 'number') return reply.code(400).send({ error: 'invalid_input' })
const db = request.server.db
const userId = request.user!.id
if (matchAlbumId != null) {
const album = db
.prepare('SELECT id FROM digital_albums WHERE id = ? AND user_id = ?')
.get(matchAlbumId, userId)
if (!album) return reply.code(404).send({ error: 'album_not_found' })
}
let release let release
try { try {
release = await client.getRelease(releaseId) release = await client.getRelease(releaseId)
@@ -71,12 +81,11 @@ export async function registerCollectionRoutes(app: FastifyInstance): Promise<vo
return reply.code(code).send(body) return reply.code(code).send(body)
} }
const db = request.server.db const barcodeStr = typeof barcode === 'string' ? barcode : undefined
const userId = request.user!.id
const artworkFile = release.coverUrl const artworkFile = release.coverUrl
? await cacheArtwork(request.server.config.artworkDir, release.coverUrl, request.server.fetchImpl) ? await cacheArtwork(request.server.config.artworkDir, release.coverUrl, request.server.fetchImpl)
: null : null
const barcodes = barcode && !release.barcodes.includes(barcode) ? [...release.barcodes, barcode] : release.barcodes const barcodes = barcodeStr && !release.barcodes.includes(barcodeStr) ? [...release.barcodes, barcodeStr] : release.barcodes
let itemId: number let itemId: number
try { try {
@@ -111,10 +120,6 @@ export async function registerCollectionRoutes(app: FastifyInstance): Promise<vo
} }
if (matchAlbumId != null) { if (matchAlbumId != null) {
const album = db
.prepare('SELECT id FROM digital_albums WHERE id = ? AND user_id = ?')
.get(matchAlbumId, userId)
if (!album) return reply.code(404).send({ error: 'album_not_found' })
db.prepare('INSERT INTO match_links (user_id, item_id, album_id) VALUES (?, ?, ?)').run( db.prepare('INSERT INTO match_links (user_id, item_id, album_id) VALUES (?, ?, ?)').run(
userId, userId,
itemId, itemId,