fix: prevent MongoDB query crashes by enforcing strict pagination val… - #42
Conversation
|
Someone is attempting to deploy a commit to the Parv Aggarwal's projects Team on Vercel. A member of the Team first needs to authorize it. |
📝 WalkthroughWalkthroughIn ChangesPagination Validation Refactor
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@barterly-backend/src/validations/barter.validation.js`:
- Around line 74-75: Persist the result of schema parsing before the controller
runs, since validate.middleware.js currently ignores schema.parseAsync(...)’s
returned data and getMyBarters still sees raw req.query values instead of the
parsed defaults from barter.validation.js. Update the validate.middleware.js
flow so the parsed query object is assigned back onto req or passed through to
the next handler, and make sure getMyBarters reads the validated query data
rather than req.query directly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 228eaaf5-f28f-42f0-9670-d463a4c0e03e
📒 Files selected for processing (1)
barterly-backend/src/validations/barter.validation.js
| page: z.coerce.number().int().positive().optional().default(1), | ||
| limit: z.coerce.number().int().positive().optional().default(10), |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== validate middleware =="
sed -n '1,80p' barterly-backend/src/middlewares/validate.middleware.js
echo
echo "== barter controller consumer =="
sed -n '1,90p' barterly-backend/src/controllers/barter.controller.js
echo
echo "== other direct req.query.page/limit consumers =="
rg -n -C2 '\breq\.query\.(page|limit)\b' barterly-backend/srcRepository: Parvaggarwal01/Barterly
Length of output: 6749
Persist the parsed query before calling the controller. validate.middleware.js drops schema.parseAsync(...)’s return value, so getMyBarters still reads raw req.query.page / req.query.limit strings and never gets these schema defaults. Assign the parsed query back to req or consume the parsed object directly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@barterly-backend/src/validations/barter.validation.js` around lines 74 - 75,
Persist the result of schema parsing before the controller runs, since
validate.middleware.js currently ignores schema.parseAsync(...)’s returned data
and getMyBarters still sees raw req.query values instead of the parsed defaults
from barter.validation.js. Update the validate.middleware.js flow so the parsed
query object is assigned back onto req or passed through to the next handler,
and make sure getMyBarters reads the validated query data rather than req.query
directly.
2 participants
…idation
What Changed
-What Changed Replaced the .transform((val) => parseInt(val)) logic in src/validations/barter.validation.js with Zod's strict native coercion: z.coerce.number().int().positive().
Why
-To prevent a 500 Internal Server Error crash when invalid (non-numeric) query parameters (like ?page=abc) are passed to the barter list endpoints. The previous logic allowed NaN to propagate into the MongoDB service layer, causing a database skip calculation error. The new logic properly catches it at the validation layer.
How To Test
-Run the backend server locally using npm run dev.
Send a GET request to /api/barters?page=abc&limit=xyz.
Verify that instead of crashing the server, it returns a 400 Bad Request with a "Expected number, received nan" validation error.
Screenshots
Add screenshots or screen recordings for UI changes.
Related Issue
Closes #
Checklist
CONTRIBUTING.md.Notes
Used AI assistance to help identify the optimal Zod validation syntax and ensure the local testing environment was correctly configured.
Summary by CodeRabbit