AOSSIE-Org / AOSSIE-Org/NeuroTrack

BUG: evaluate-assessments Edge Function crashes on missing/malformed input and silently returns zero score on unmatched answers

Đang mở
#171 0 bình luận 0 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
Dart
Star
29
Fork
50
Chỉ số merge pull request
Không có pull request nào được merge trong 30 ngày

Mô tả

### Is there an existing issue for this?

- [x] I have searched the existing issues

### What happened?

## 📌 Issue Overview

The `evaluate-assessments` Edge Function has two related bugs:

1. **No input validation** — if the request body is empty, malformed JSON,
or missing `patient_id`, `assessment_id`, or `questions`, the function
crashes with an unhandled `TypeError` (e.g. `questions.map is not a
function`) before reaching the try/catch, returning a 500 with no useful
error message.

2. **Silent zero score** — if none of the submitted `question_id`/`answer_id`
pairs match the assessment data (e.g. stale client data, wrong IDs), the
scoring loop silently `continue`s every iteration, `totalScore` stays 0,
and the patient is incorrectly told they are not autistic. There is no
warning that 0 out of N questions were scored.
## 🔍 Steps to Reproduce
**Bug 1 — Null dereference:**
```bash
curl -X POST https://.supabase.co/functions/v1/evaluate-assessments \
-H "Content-Type: application/json" \
-d '{}'
# Returns 500 Internal Server Error — questions is undefined, .map() crashes
```

**Bug 2 — Silent zero score:**
```bash
curl -X POST https://.supabase.co/functions/v1/evaluate-assessments \
-H "Content-Type: application/json" \
-d '{"patient_id":"...","assessment_id":"...","questions":[{"question_id":"wrong-id","answer_id":"wrong-id"}]}'
# Returns 200 with assessment_score: 0 and is_autistic: false — silently wrong
```

## 🎯 Expected Behavior
1. Missing or malformed input should return a `400 Bad Request` with a clear
error message before any processing begins.
2. If 0 out of N questions were successfully scored, the function should
return an error rather than a misleading result.

## 🚨 Actual Behavior

1. `questions.map(...)` throws `TypeError: Cannot read properties of undefined`
when `questions` is missing from the request body.
2. A patient who submits an assessment with entirely unmatched answers receives
`assessment_score: 0` and `is_autistic: false` — a clinically dangerous
false negative.

**Root cause — `supabase/functions/evaluate-assessments/index.ts`:**
```ts
// No validation — patient_id, assessment_id, questions can all be undefined
const { patient_id, assessment_id, questions } = await req.json();

// Crashes if questions is undefined
questions.map((q: AssessmentEvaluationQuestionDTO) => ({ ... }))

// Silent zero — no check that at least 1 question was scored
let totalScore = 0;
for(let i=0; i
N/A
## 💡 Suggested Improvements

```ts
// 1. Validate input early
const body = await req.json().catch(() => null);
if (!body || !body.patient_id || !body.assessment_id || !Array.isArray(body.questions) || body.questions.length === 0) {
return new Response(JSON.stringify({ error: "Missing or invalid request body" }), { status: 400 });
}

// 2. Check that at least 1 question was scored
let scoredCount = 0;
for (...) {
...
totalScore += answer.score;
scoredCount++;
}
if (scoredCount === 0) {
return new Response(JSON.stringify({ error: "No questions could be scored — check question and answer IDs" }), { status: 422 });
}
```

### Record

- [x] I agree to follow this project's Code of Conduct
- [x] I want to work on this issue

Hướng dẫn đóng góp

Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.