0.3.49

server/internal/api/admin_test.go

@@ -947,4 +947,26 @@ func TestToRowEventValidatesAndClamps(t *testing.T) {
 			t.Fatalf("user should come from the session, got %q", event.UserID)
 		}
 	})
+
+	t.Run("rejects free text in the controlled fields", func(t *testing.T) {
+		cases := []rowEventPayload{
+			{RowID: "row with spaces", Event: "focus"},
+			{RowID: "r", RowKind: "MOVIES; drop table", Event: "focus"},
+			{RowID: "r", Event: "focus", ItemID: "not/an/id"},
+			{RowID: strings.Repeat("x", 101), Event: "focus"},
+		}
+		for _, payload := range cases {
+			if _, ok := toRowEvent(payload, "u", now); ok {
+				t.Fatalf("expected %+v to be dropped", payload)
+			}
+		}
+	})
+
+	t.Run("keeps a well-formed curated row id", func(t *testing.T) {
+		event, ok := toRowEvent(
+			rowEventPayload{RowID: "curated:movies:genre:science-fiction", RowKind: "movies", Event: "impression"}, "u", now)
+		if !ok || event.RowID != "curated:movies:genre:science-fiction" {
+			t.Fatalf("a normal composed row id should pass, got ok=%v event=%+v", ok, event)
+		}
+	})
 }