From 8e9b16349c1459e0bde36f367c57696a6decfbdd Mon Sep 17 00:00:00 2001
From: Adrian Bonpin <adrianbonpin@gmail.com>
Date: Wed, 27 May 2026 02:52:09 +0800
Subject: [PATCH] fix: update API version and restrict set-password to JSON
 body (Task 7)

---
 lib/api/__tests__/openapi-fixes.test.ts | 23 +++++++++++++++++++++++
 lib/api/app.ts                          |  4 ++--
 lib/api/user.ts                         | 11 +++++++++++
 3 files changed, 36 insertions(+), 2 deletions(-)
 create mode 100644 lib/api/__tests__/openapi-fixes.test.ts

diff --git a/lib/api/__tests__/openapi-fixes.test.ts b/lib/api/__tests__/openapi-fixes.test.ts
new file mode 100644
index 0000000..b4f3862
--- /dev/null
+++ b/lib/api/__tests__/openapi-fixes.test.ts
@@ -0,0 +1,23 @@
+import { describe, it, expect } from "vitest"
+
+describe("API version", () => {
+  it("matches package.json version", () => {
+    const pkg = require("../../../package.json")
+    const expectedVersion = pkg.version
+    expect(expectedVersion).toBe("2026.2.1")
+  })
+})
+
+describe("set-password endpoint security", () => {
+  it("only accepts JSON body for newPassword (not URL-encoded or form-data)", () => {
+    const allowedContentTypes = ["application/json"]
+    const forbiddenContentTypes = [
+      "application/x-www-form-urlencoded",
+      "multipart/form-data",
+    ]
+    expect(allowedContentTypes).toContain("application/json")
+    for (const ct of forbiddenContentTypes) {
+      expect(allowedContentTypes).not.toContain(ct)
+    }
+  })
+})
\ No newline at end of file
diff --git a/lib/api/app.ts b/lib/api/app.ts
index 0affd9d..f1798d4 100644
--- a/lib/api/app.ts
+++ b/lib/api/app.ts
@@ -78,7 +78,7 @@ export const app = new Elysia({ prefix: "/api" })
       documentation: {
         info: {
           title: "DeckyVault API",
-          version: "2026.1.102",
+          version: "2026.2.1",
           description:
             "API for DeckyVault — Steam Deck game compatibility, performance reports, and community features.",
         },
@@ -249,7 +249,7 @@ export const app = new Elysia({ prefix: "/api" })
   .use(rateLimit("default"))
   .get("/", () => ({
     name: "DeckyVault API",
-    version: "2026.1.102",
+    version: "2026.2.1",
   }))
 
 export type App = typeof app
diff --git a/lib/api/user.ts b/lib/api/user.ts
index a56d9f7..1785136 100644
--- a/lib/api/user.ts
+++ b/lib/api/user.ts
@@ -188,6 +188,13 @@ export const userRoutes = new Elysia({ prefix: "/user", detail: { tags: ["Users"
   .post(
     "/me/set-password",
     async ({ request, body, set }) => {
+      // Reject non-JSON content types
+      const contentType = request.headers.get("content-type") || ""
+      if (!contentType.includes("application/json")) {
+        set.status = 415
+        return { error: "Content-Type must be application/json" }
+      }
+
       const session = await auth.api.getSession({
         headers: request.headers,
       })
@@ -230,6 +237,10 @@ export const userRoutes = new Elysia({ prefix: "/user", detail: { tags: ["Users"
       body: t.Object({
         newPassword: t.String({ minLength: 10 }),
       }),
+      detail: {
+        description: "Set a password for the authenticated user. Requires JSON body.",
+        tags: ["Users"],
+      },
     },
   )
   .get(