From 0836dfdaa0fe624e299b08d0ffaddfbe8befe230 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 13 Apr 2026 22:30:20 +0000 Subject: [PATCH] fix: validate action filter URL param against known enum values The action filter on the audit log route was cast directly from the URL search param to AuditAction without validation. An invalid value would be passed into the Drizzle inArray() call, potentially throwing a PostgreSQL enum type error. Now validates against the actual enum values before using the filter. https://claude.ai/code/session_01NdiwK2fbtKhAD3XuD58fTm --- app/routes/leagues/$leagueId.audit-log.tsx | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/app/routes/leagues/$leagueId.audit-log.tsx b/app/routes/leagues/$leagueId.audit-log.tsx index 2d79586..f5f3daf 100644 --- a/app/routes/leagues/$leagueId.audit-log.tsx +++ b/app/routes/leagues/$leagueId.audit-log.tsx @@ -31,6 +31,9 @@ import { findCurrentSeasonWithSports } from "~/models/season"; import { findTeamsBySeasonId } from "~/models/team"; import { getAuditLogForSeason, type AuditAction, type AuditLogEntry } from "~/models/audit-log"; import { AUDIT_ACTION_LABELS, formatAuditDetail } from "~/lib/audit-log-display"; +import * as schema from "~/database/schema"; + +const VALID_AUDIT_ACTIONS = new Set(schema.auditActionEnum.enumValues); export function meta({ data }: Route.MetaArgs): Route.MetaDescriptors { return [{ title: `Audit Log — ${data?.league?.name ?? "League"} - Brackt` }]; @@ -80,7 +83,9 @@ export async function loader(args: Route.LoaderArgs) { const searchParams = new URL(request.url).searchParams; const page = Math.max(0, parseInt(searchParams.get("page") ?? "0", 10) || 0); - const actionFilter = searchParams.get("action") as AuditAction | null; + const rawAction = searchParams.get("action"); + const actionFilter: AuditAction | null = + rawAction && VALID_AUDIT_ACTIONS.has(rawAction) ? (rawAction as AuditAction) : null; const [auditLog, teams] = await Promise.all([ getAuditLogForSeason(season.id, {