From 75c23448b46ae53fe9634b6f76cbfad037d04042 Mon Sep 17 00:00:00 2001
From: ZGaetano <zgaetano@wilddragon.net>
Date: Mon, 25 May 2026 17:40:58 -0400
Subject: [PATCH] fix(#65): GET /schedules returns 400 for unknown status query
 param

---
 services/mam-api/src/routes/schedules.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/services/mam-api/src/routes/schedules.js b/services/mam-api/src/routes/schedules.js
index aee4e7b..5ac4a04 100644
--- a/services/mam-api/src/routes/schedules.js
+++ b/services/mam-api/src/routes/schedules.js
@@ -30,10 +30,15 @@ function rowToJson(r) {
   };
 }
 
+const ALLOWED_STATUS_FILTER = new Set(['all', 'upcoming', 'past']);
+
 // GET /api/v1/schedules?status=upcoming|past|all
 router.get('/', async (req, res, next) => {
   try {
     const status = (req.query.status || 'all').toLowerCase();
+    if (!ALLOWED_STATUS_FILTER.has(status)) {
+      return res.status(400).json({ error: `status must be one of: ${[...ALLOWED_STATUS_FILTER].join(', ')}` });
+    }
     let where = 'TRUE';
     if (status === 'upcoming') where = `(s.status IN ('pending','running') OR s.end_at >= NOW() - INTERVAL '1 hour')`;
     else if (status === 'past') where = `s.status IN ('completed','failed','cancelled') AND s.end_at < NOW()`;