TemaDeveloper / TemaDeveloper/personal_planner
bug: notes/databases/[id] GET/PATCH/DELETE 500 on malformed id (missing ObjectId.isValid)
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 2
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
Description
src/app/api/notes/databases/[id]/route.ts passes the raw id straight into Mongoose (findOne/findOneAndUpdate/deleteOne({ _id: id, ... })) with no ObjectId.isValid guard and no try/catch — GET (:13-15), PATCH (:36/:78), DELETE (:87-88). A non-ObjectId id throws a Mongoose CastError that is never caught. The sibling row routes already validate (rows/route.ts:14, rows/[rowId]/route.ts:22), confirming the inconsistency.
Failure scenario
GET /api/notes/databases/not-an-id → uncaught CastError → 500 instead of a clean 404.
Fix
Add the same mongoose.Types.ObjectId.isValid(id) early-return-404 used by the row routes to all three handlers.
Severity
Low-Medium (robustness).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/app/api/notes/databases/[id]/route.ts and compare its GET, PATCH, and DELETE handlers with rows/route.ts and rows/[rowId]/route.ts, which show the existing validation pattern. Verify that malformed IDs return 404 rather than an uncaught CastError for all three handlers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- mongodb, typescript
- Domain
- api, backend, database
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 82/100