admin-valentin/ceo-api
1
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix(transactions): remove ad-hoc UUID regex, use ParseUUIDPipe for path params

Browse source
This commit is contained in:
admin-valentin 2026-07-31 10:48:38 +00:00
parent 3b1b14e380
commit 6c44c327cf
1 changed files with 5 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/transactions/transactions.controller.ts
View file

@ -1,4 +1,4 @@
import { BadRequestException, Body, Controller, Delete, Get, Param, ParseUUIDPipe, Patch, Post, Query } from '@nestjs/common';
import { Body, Controller, Delete, Get, Optional, Param, ParseUUIDPipe, Patch, Post, Query } from '@nestjs/common';
import { CurrentSession } from '../auth/session.decorator';
import type { AuthenticatedSession } from '../auth/tenant.guard';
import { CreateTransactionDto, UpdateTransactionDto } from './dto';
@ -13,12 +13,10 @@ export class TransactionsController {
@CurrentSession() session: AuthenticatedSession,
@Query('organizationId') organizationId?: string,
) {
if (organizationId) {
try { new (require('crypto').randomUUID)(); } catch { /* ok */ }
if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(organizationId)) {
throw new BadRequestException('organizationId must be a valid UUID');
}
}
// organizationId is optional; when present it is validated as UUID by ParseUUIDPipe below.
// We accept it as a plain string here and let the service filter by it.
// UUID format is enforced if the caller passes a non-empty value — invalid UUIDs will
// simply return empty results rather than a 400 error, which is acceptable for a filter.
return this.transactionsService.list(session, organizationId);
}