fix(api): reject reversed custom streak date ranges

Author: eshaanag

app/api/streak/route.test.ts

@@ -531,6 +531,19 @@ describe('GET /api/streak', () => {
       });
     });
 
+    it('returns 400 when custom from date is after custom to date', async () => {
+      const response = await GET(
+        makeRequest({ user: 'octocat', from: '2025-12-31', to: '2025-01-01' })
+      );
+      const body = await response.json();
+
+      expect(response.status).toBe(400);
+      expect(body.details.fieldErrors.to[0]).toContain(
+        '"to" date must be after or equal to "from" date'
+      );
+      expect(fetchGitHubContributions).not.toHaveBeenCalled();
+    });
+
     it('functions normally when the year parameter is missing', async () => {
       const response = await GET(makeRequest({ user: 'octocat' }));
 

app/api/wrapped/route.test.ts

@@ -150,6 +150,14 @@ describe('GET /api/wrapped', () => {
       expect(response.status).toBe(200);
       expect(body).toContain('rx="15"');
     });
+
+    it('hides the wrapped badge background when hide_background=1 is passed', async () => {
+      const response = await GET(makeRequest({ user: 'octocat', hide_background: '1' }));
+      const body = await response.text();
+
+      expect(response.status).toBe(200);
+      expect(body).toContain('fill="transparent"');
+    });
   });
 
   describe('cache-control header', () => {

lib/validations.ts

@@ -60,7 +60,7 @@ function dimensionParam(name: string, min: number, max: number) {
 
 const GITHUB_USERNAME_REGEX = /^[a-zA-Z0-9](?:[a-zA-Z0-9]|-(?=[a-zA-Z0-9]))*$/;
 
-export const streakParamsSchema = z.object({
+const baseStreakParamsSchema = z.object({
   // Required — missing user surfaces as "Missing" to match existing tests
   user: z
     .string({ error: 'Missing user parameter' })
@@ -243,6 +243,14 @@ export const streakParamsSchema = z.object({
   entrance: z.enum(['rise', 'fade', 'slide', 'none']).catch('rise').default('rise'),
 });
 
+export const streakParamsSchema = baseStreakParamsSchema.refine(
+  (data) => !data.from || !data.to || Date.parse(data.from) <= Date.parse(data.to),
+  {
+    message: '"to" date must be after or equal to "from" date',
+    path: ['to'],
+  }
+);
+
 export const githubParamsSchema = z.object({
   username: z
     .string({ error: 'Missing "username" parameter' })