Skip to content

fix(j0di3): Validate troopId UUID format before proxying (closes #1066)#1113

Open
jeromehardaway wants to merge 1 commit into
masterfrom
fix/jodie-troopid-format-validation
Open

fix(j0di3): Validate troopId UUID format before proxying (closes #1066)#1113
jeromehardaway wants to merge 1 commit into
masterfrom
fix/jodie-troopid-format-validation

Conversation

@jeromehardaway

Copy link
Copy Markdown
Contributor

Summary

  • `src/lib/j0di3-proxy.ts` previously only rejected falsy `troopId`, so a stale session or botched migration could let a malformed value through and surface as an opaque 4xx/5xx from the J0dI3 backend.
  • Added a UUID-shape check (covers any RFC-4122 variant — J0dI3 issues these in `ensure-troop.ts`). On reject: `400` with `"Your troop profile is invalid. Please sign out and sign back in to refresh it."` and a `console.warn` of the redacted value so we can investigate.
  • Updated test fixture to use a real UUID and added a test for the rejection path.

Closes #1066.

Test plan

  • `npx vitest run tests/lib/j0di3/j0di3-proxy.test.ts` — 7/7 pass
  • `npx biome check` on changed files — clean
  • Manual: edit a user's `troopId` to a malformed value in the DB, hit any `/api/j0di3/*` route, confirm 400 with the new message rather than an opaque backend error

Closes #1066.

J0dI3 issues UUIDs for troop IDs in ensure-troop.ts, but j0di3-proxy
only checked truthiness. A stale session or botched migration could
let a malformed value through and surface to the user as an opaque
4xx/5xx from the backend.

The proxy now rejects anything that doesn't match the UUID shape with
a 400 and a clear "sign out and back in" message, and logs the
redacted value so we can investigate how it got there. Existing
fixture switched to a real UUID and a new test covers the rejection
path.
@vercel

vercel Bot commented May 13, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
vets-who-code-app Ready Ready Preview, Comment May 13, 2026 2:47am

Request Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Validate J0dI3 troopId format before proxying requests

1 participant