From 60266ad9c90f1399aa812f7ba68b23d24d7cf78e Mon Sep 17 00:00:00 2001 From: Adrian Bonpin Date: Mon, 29 Jun 2026 00:46:45 +0800 Subject: [PATCH] fix(api): filter empty/invalid screenshot IDs before ANY query The PATCH /api/performance/:id/edit endpoint was passing raw removedScreenshotIds from the client to an = ANY() SQL clause. Empty strings or invalid values would crash the query. Added a filter to ensure only non-empty string IDs are used. --- apps/web/lib/api/performance.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/apps/web/lib/api/performance.ts b/apps/web/lib/api/performance.ts index e7c7fa2..bde69e8 100644 --- a/apps/web/lib/api/performance.ts +++ b/apps/web/lib/api/performance.ts @@ -403,9 +403,9 @@ export const performanceVerifyRoutes = new Elysia({ .returning() // ── Remove screenshots marked for deletion ──────────────────────── - const removedIds: string[] = Array.isArray(payload.removedScreenshotIds) - ? payload.removedScreenshotIds - : [] + const removedIds: string[] = (Array.isArray(payload.removedScreenshotIds) + ? payload.removedScreenshotIds.filter((id: unknown) => typeof id === "string" && id.length > 0) + : []) if (removedIds.length > 0) { // Fetch storage keys before deleting rows