AOSSIE-Org / AOSSIE-Org/NeuroTrack

BUG: evaluate-assessments Edge Function crashes on missing/malformed input and silently returns zero score on unmatched answers

Aperta
#171 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Dart
Stelle
29
Fork
50
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

### Is there an existing issue for this?

- [x] I have searched the existing issues

### What happened?

## 📌 Issue Overview

The `evaluate-assessments` Edge Function has two related bugs:

1. **No input validation** — if the request body is empty, malformed JSON,
or missing `patient_id`, `assessment_id`, or `questions`, the function
crashes with an unhandled `TypeError` (e.g. `questions.map is not a
function`) before reaching the try/catch, returning a 500 with no useful
error message.

2. **Silent zero score** — if none of the submitted `question_id`/`answer_id`
pairs match the assessment data (e.g. stale client data, wrong IDs), the
scoring loop silently `continue`s every iteration, `totalScore` stays 0,
and the patient is incorrectly told they are not autistic. There is no
warning that 0 out of N questions were scored.
## 🔍 Steps to Reproduce
**Bug 1 — Null dereference:**
```bash
curl -X POST https://.supabase.co/functions/v1/evaluate-assessments \
-H "Content-Type: application/json" \
-d '{}'
# Returns 500 Internal Server Error — questions is undefined, .map() crashes
```

**Bug 2 — Silent zero score:**
```bash
curl -X POST https://.supabase.co/functions/v1/evaluate-assessments \
-H "Content-Type: application/json" \
-d '{"patient_id":"...","assessment_id":"...","questions":[{"question_id":"wrong-id","answer_id":"wrong-id"}]}'
# Returns 200 with assessment_score: 0 and is_autistic: false — silently wrong
```

## 🎯 Expected Behavior
1. Missing or malformed input should return a `400 Bad Request` with a clear
error message before any processing begins.
2. If 0 out of N questions were successfully scored, the function should
return an error rather than a misleading result.

## 🚨 Actual Behavior

1. `questions.map(...)` throws `TypeError: Cannot read properties of undefined`
when `questions` is missing from the request body.
2. A patient who submits an assessment with entirely unmatched answers receives
`assessment_score: 0` and `is_autistic: false` — a clinically dangerous
false negative.

**Root cause — `supabase/functions/evaluate-assessments/index.ts`:**
```ts
// No validation — patient_id, assessment_id, questions can all be undefined
const { patient_id, assessment_id, questions } = await req.json();

// Crashes if questions is undefined
questions.map((q: AssessmentEvaluationQuestionDTO) => ({ ... }))

// Silent zero — no check that at least 1 question was scored
let totalScore = 0;
for(let i=0; i
N/A
## 💡 Suggested Improvements

```ts
// 1. Validate input early
const body = await req.json().catch(() => null);
if (!body || !body.patient_id || !body.assessment_id || !Array.isArray(body.questions) || body.questions.length === 0) {
return new Response(JSON.stringify({ error: "Missing or invalid request body" }), { status: 400 });
}

// 2. Check that at least 1 question was scored
let scoredCount = 0;
for (...) {
...
totalScore += answer.score;
scoredCount++;
}
if (scoredCount === 0) {
return new Response(JSON.stringify({ error: "No questions could be scored — check question and answer IDs" }), { status: 422 });
}
```

### Record

- [x] I agree to follow this project's Code of Conduct
- [x] I want to work on this issue

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.