fix(flashcard): add ObjectId validation to reviewFlashcard and deleteFlashcard (#1197)

[suhaniiz]

📝 Pull Request Description

Related Issue

Closes #1197

Summary

Passing a malformed or non-24-character hexadecimal string as an :id parameter in PUT /api/flashcards/:id/review or DELETE /api/flashcards/:id caused Mongoose to throw an unhandled CastError. This was caught by the generic catch block, returning a 500 Internal Server Error instead of a user-facing validation error.

This PR adds early mongoose.Types.ObjectId.isValid(id) validation checks to both reviewFlashcard and deleteFlashcard controllers, returning a 400 Bad Request with {"success": false, "message": "Invalid flashcard ID format"} when an invalid ID is provided.

---

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature
• ♻️ Refactoring
• 📝 Documentation update
• 🎨 UI/UX improvement
• 🔥 Other(please describe) ______

---

How Has This Been Tested?

Describe the testing steps performed.

• Tested PUT /api/flashcards/invalid-id-123/review with a valid body and confirmed it returns HTTP 400 with Invalid flashcard ID format.
• Tested DELETE /api/flashcards/invalid-id-123 and confirmed it returns HTTP 400 with Invalid flashcard ID format.
• Verified that valid 24-hex string ObjectIds still work as expected (returning 200 or 404 if card doesn't exist).

---

Screenshots (if applicable)

N/A (Backend API response status fix)

---

Checklist

• My code follows the project's guidelines
• I have tested my changes
• I have updated documentation where necessary
• I have linked the related issue
• My changes do not introduce new warnings or errors

Adds ObjectId validation for flashcard review and deletion endpoints. Invalid IDs now return HTTP 400 with Invalid flashcard ID format instead of causing HTTP 500 errors.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0de79824-0ba2-433c-b1e4-c1cf5c5882d5

📥 Commits

Reviewing files that changed from the base of the PR and between 8ba0a98 and f3b131a.

📒 Files selected for processing (1)

• backend/controllers/flashcardController.js

---

📝 Walkthrough

Walkthrough

The flashcard controller now validates IDs before review and delete queries. Invalid IDs return HTTP 400. Stats calculation preserves the current timestamp while deriving the start-of-day value.

Changes

Flashcard controller updates

Layer / File(s)	Summary
Flashcard ID validation backend/controllers/flashcardController.js	The controller uses Mongoose ObjectId validation for review and delete requests. Malformed IDs return HTTP 400 before database queries.
Stats date handling backend/controllers/flashcardController.js	The stats calculation clones the current date before resetting its time fields. The module export remains unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• Canopus-Labs/PrepPilot#1480: Adds similar ObjectId validation in other controllers.
• Canopus-Labs/PrepPilot#1526: Contains the same stats date-cloning fix.

Suggested reviewers: tmdeveloper007, saurabhhhcodes, nayanraj864-cmyk

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The stats date-cloning change is unrelated to the linked issue's ObjectId validation requirements.	Remove the unrelated stats date-cloning change or link it to a separate issue.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the flashcard controller fix and the added ObjectId validation.
Linked Issues check	✅ Passed	The changes validate IDs in both required controllers and return HTTP 400 with the specified message.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}