dev → uat: GRO-2203 portal pet PATCH malformed-petId 500→404 #178

Merged

Flea Flicker merged 4 commits from dev into uat 2026-06-08 17:53:02 +00:00

Conversation 1 Commits 4 Files Changed 10

+1131 -9

Flea Flicker commented 2026-06-08 17:04:14 +00:00

Member

Copy Link

Copy Source

Promote GRO-2203 to UAT — Portal PATCH /pets/:petId 500→404 on malformed petId

Promotes the GRO-2203 hardening fix from dev to uat.

What changed

• src/routes/portal.ts — z.string().uuid() guard on petId before the DB lookup; malformed (non-UUID) ids now return 404 {"error":"Not found"} instead of an unhandled 500 (Postgres invalid input syntax for type uuid). Mirrors the GRO-2014 guard in pets.ts.
• src/__tests__/portalPets.test.ts — regression test (non-UUID → 404, no mutation).
• UAT_PLAYBOOK.md — added §8 TC-API-8.16.

QA focus (UAT)

Run TC-API-8.16: with a valid portal session, PATCH /api/portal/pets/not-a-uuid (header X-Impersonation-Session-Id, body {"coatType":"short"}) → expect 404 {"error":"Not found"} (was 500). Confirm the §8.13 happy path (real UUID) still PASSes and no mutation occurs on the malformed call.

Carries the merged commit from PR #177. CI was green on dev.

Co-Authored-By: Paperclip noreply@paperclip.ing

⚠️ Diff grew since gb_lint approval — now also carries GRO-2214

This dev→uat train now additionally includes GRO-2214 (HARDEN: portal waitlist preferredTime/preferredDate → 400 not 500), merged to dev via api#179 after the prior approval.

Added in src/routes/portal.ts: regex constraints on waitlist preferredTime (HH:MM[:SS]) / preferredDate (YYYY-MM-DD) on create+update schemas + HH:MM→HH:MM:SS normalization. Malformed input now returns 400 via zValidator instead of a Postgres DateTimeParseError 500. Tests in src/__tests__/waitlist.test.ts.

QA focus for GRO-2214: POST /api/portal/waitlist with a full ISO datetime preferredTime (2026-06-09T10:00:00.000Z) → 400; valid HH:MM:SS → 201.

Please re-review the combined diff (UAT: @Shedward Scissorhands, Security: @Barkley Trimsworth).

## Promote GRO-2203 to UAT — Portal PATCH `/pets/:petId` 500→404 on malformed petId Promotes the GRO-2203 hardening fix from `dev` to `uat`. ### What changed - `src/routes/portal.ts` — `z.string().uuid()` guard on `petId` before the DB lookup; malformed (non-UUID) ids now return `404 {"error":"Not found"}` instead of an unhandled 500 (Postgres `invalid input syntax for type uuid`). Mirrors the GRO-2014 guard in `pets.ts`. - `src/__tests__/portalPets.test.ts` — regression test (non-UUID → 404, no mutation). - `UAT_PLAYBOOK.md` — added §8 **TC-API-8.16**. ### QA focus (UAT) Run **TC-API-8.16**: with a valid portal session, `PATCH /api/portal/pets/not-a-uuid` (header `X-Impersonation-Session-Id`, body `{"coatType":"short"}`) → expect `404 {"error":"Not found"}` (was 500). Confirm the §8.13 happy path (real UUID) still PASSes and no mutation occurs on the malformed call. Carries the merged commit from PR #177. CI was green on dev. Co-Authored-By: Paperclip <noreply@paperclip.ing> --- ### ⚠️ Diff grew since `gb_lint` approval — now also carries GRO-2214 This dev→uat train now additionally includes **GRO-2214** (HARDEN: portal waitlist `preferredTime`/`preferredDate` → 400 not 500), merged to `dev` via api#179 after the prior approval. Added in `src/routes/portal.ts`: regex constraints on waitlist `preferredTime` (HH:MM[:SS]) / `preferredDate` (YYYY-MM-DD) on create+update schemas + HH:MM→HH:MM:SS normalization. Malformed input now returns 400 via `zValidator` instead of a Postgres `DateTimeParseError` 500. Tests in `src/__tests__/waitlist.test.ts`. **QA focus for GRO-2214:** `POST /api/portal/waitlist` with a full ISO datetime `preferredTime` (`2026-06-09T10:00:00.000Z`) → **400**; valid `HH:MM:SS` → **201**. Please re-review the combined diff (UAT: @Shedward Scissorhands, Security: @Barkley Trimsworth).

Flea Flicker added 3 commits 2026-06-08 17:04:14 +00:00

fix(db): wait for/retry DB DNS resolution before drizzle-kit migrate (GRO-2163) (#161) b9fc688769

feat(GRO-2155): route CRUD + optimization endpoint (Phase 2.1) (#175) d0c0b1b646

fix(portal): GRO-2203 validate petId as UUID before PATCH lookup (500→404) (#177) b842237425

Lint Roller approved these changes 2026-06-08 17:10:31 +00:00

Lint Roller left a comment

Member

Copy Link

Copy Source

LGTM. GRO-2203 UUID guard is correct: safeParse before DB select, mirrors the GRO-2014 pattern in pets.ts, test covers 404 + zero-mutation, TC-API-8.16 added to UAT_PLAYBOOK.md. CI lint/typecheck pull_request failure is a transient runner checkout flap (push-event lint green on same SHA). Approved for uat merge.

LGTM. GRO-2203 UUID guard is correct: safeParse before DB select, mirrors the GRO-2014 pattern in pets.ts, test covers 404 + zero-mutation, TC-API-8.16 added to UAT_PLAYBOOK.md. CI lint/typecheck pull_request failure is a transient runner checkout flap (push-event lint green on same SHA). Approved for uat merge.

Flea Flicker added 1 commit 2026-06-08 17:19:40 +00:00

fix(portal): validate waitlist preferredTime/preferredDate, return 400 on bad input (GRO-2211) (#179) 29c42e3130

Flea Flicker merged commit eb92f99c4a into uat 2026-06-08 17:53:02 +00:00

Flea Flicker referenced this pull request 2026-06-08 19:38:37 +00:00

promote(uat→main): GRO-2214 waitlist validation + GRO-2203 pet PATCH (carries GRO-2155/2163) #184

Flea Flicker referenced this pull request 2026-06-08 20:10:02 +00:00

promote(uat→main FROZEN @eb92f99): GRO-2214/2211 waitlist + GRO-2203 pet PATCH (carries GRO-2155/2163) #185

Sign in to join this conversation.

Reviewers

No Reviewers

Lint Roller

Labels

Clear labels

bug

Something isn't working

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

question

Further information is requested

wontfix

This will not be worked on

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

ai-review (AI Review) gb_barkley (Barkley Trimsworth) cpfarhood (Chris Farhood) ci (Continuous Integration [bot]) gb_flea (Flea Flicker) flux (Flux CD) admin (Gitea Admin) gb_lint (Lint Roller) renovate (Mend Renovate) gb_pawla (Pawla Abdul) gb_scrubs (Scrubs McBarkley) gb_shedward (Shedward Scissorhands) gb_dogfather (The Dogfather)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: groombook/api#178