fix: validate monthly badge dimensions

Author: pari7maheshwari

app/api/streak/route.test.ts

@@ -184,6 +184,17 @@ describe('GET /api/streak', () => {
       const textOutput = await response.text();
       expect(textOutput).toContain('<svg');
     });
+
+    it('returns 400 when org contains invalid characters', async () => {
+      const response = await GET(
+        makeRequest({ user: 'octocat', org: 'invalid_org_name_with_spaces' })
+      );
+      const body = await response.json();
+
+      expect(response.status).toBe(400);
+      expect(body.details.fieldErrors.org[0]).toBe('Invalid organization name format');
+      expect(getOrgDashboardData).not.toHaveBeenCalled();
+    });
   });
 
   describe('successful response', () => {

lib/validations.ts

@@ -181,7 +181,16 @@ export const streakParamsSchema = z.object({
   grace: z.string().optional().transform(toGraceValue).default(1),
   mode: z.enum(['commits', 'loc']).catch('commits').default('commits'),
   repo: z.string().optional(),
-  org: z.string().optional(),
+  org: z
+    .string()
+    .optional()
+    .refine(
+      (val) => {
+        if (!val) return true;
+        return /^[a-zA-Z0-9](?:[a-zA-Z0-9]|-(?=[a-zA-Z0-9]))*$/.test(val);
+      },
+      { message: 'Invalid organization name format' }
+    ),
   labels: z.string().optional().transform(toBooleanFlag),
   labelColor: z
     .string()