BUG: `GET /schedules?status=invalid` returns all schedules instead of 400 #65

New issue

Closed

opened 2026-05-25 03:31:03 -04:00 by zgaetano · 0 comments

zgaetano commented

2026-05-25 03:31:03 -04:00

Owner

Bug

GET /api/v1/schedules?status=invalid silently falls through to returning all schedules (status=all behavior) instead of returning 400 Bad Request.

Location

services/mam-api/src/routes/schedules.js:20-26

const status = (req.query.status || 'all').toLowerCase();
let where = 'TRUE';
if (status === 'upcoming') ...
else if (status === 'past') ...
// status=invalid falls through to where='TRUE' — returns everything

Impact

API consumer typo (e.g. status=upcomming) silently returns wrong data
No error feedback to client

Fix

Add an allowance check:

const ALLOWED_STATUSES = new Set(['all', 'upcoming', 'past']);
if (!ALLOWED_STATUSES.has(status)) return res.status(400).json({ error: `Invalid status: ${status}` });

## Bug `GET /api/v1/schedules?status=invalid` silently falls through to returning all schedules (`status=all` behavior) instead of returning `400 Bad Request`. ## Location `services/mam-api/src/routes/schedules.js:20-26` ```js const status = (req.query.status || 'all').toLowerCase(); let where = 'TRUE'; if (status === 'upcoming') ... else if (status === 'past') ... // status=invalid falls through to where='TRUE' — returns everything ``` ## Impact - API consumer typo (e.g. `status=upcomming`) silently returns wrong data - No error feedback to client ## Fix Add an allowance check: ```js const ALLOWED_STATUSES = new Set(['all', 'upcoming', 'past']); if (!ALLOWED_STATUSES.has(status)) return res.status(400).json({ error: `Invalid status: ${status}` }); ```