From 2c2df277d105ac620a568762fc1ca39fb12ddb28 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Feb 2026 23:40:38 +0000
Subject: [PATCH] fix: validate participantIds server-side instead of trusting
 form input

Fetch participants from the DB in the action using the season ID from
the URL params, eliminating the untrusted participantIds hidden field.
Remove the now-unused hidden input from the frontend form.

https://claude.ai/code/session_01WHRynBCcugSK7HHEmN6Yuy
---
 .../admin.sports-seasons.$id.expected-values.server.ts    | 8 ++------
 app/routes/admin.sports-seasons.$id.expected-values.tsx   | 5 -----
 2 files changed, 2 insertions(+), 11 deletions(-)

diff --git a/app/routes/admin.sports-seasons.$id.expected-values.server.ts b/app/routes/admin.sports-seasons.$id.expected-values.server.ts
index 5d5a077..7435dcc 100644
--- a/app/routes/admin.sports-seasons.$id.expected-values.server.ts
+++ b/app/routes/admin.sports-seasons.$id.expected-values.server.ts
@@ -40,12 +40,8 @@ const scoringRules = {
 export async function action({ request, params }: Route.ActionArgs) {
   const formData = await request.formData();
 
-  const participantIdsRaw = formData.get("participantIds");
-  if (typeof participantIdsRaw !== "string" || !participantIdsRaw) {
-    return { error: "No participant IDs provided" };
-  }
-
-  const participantIds = participantIdsRaw.split(",").filter(Boolean);
+  const participants = await findParticipantsBySportsSeasonId(params.id);
+  const participantIds = participants.map((p: { id: string }) => p.id);
 
   try {
     const results = await Promise.all(
diff --git a/app/routes/admin.sports-seasons.$id.expected-values.tsx b/app/routes/admin.sports-seasons.$id.expected-values.tsx
index 060a75e..5358883 100644
--- a/app/routes/admin.sports-seasons.$id.expected-values.tsx
+++ b/app/routes/admin.sports-seasons.$id.expected-values.tsx
@@ -30,10 +30,6 @@ export default function ExpectedValuesPage({ loaderData, actionData }: Route.Com
     0
   );
 
-  const participantIds = participants
-    .map((p: { id: string; name: string }) => p.id)
-    .join(",");
-
   return (
     <div className="container mx-auto p-6 space-y-6">
       <div className="flex items-center gap-4">
@@ -85,7 +81,6 @@ export default function ExpectedValuesPage({ loaderData, actionData }: Route.Com
           </div>
 
           <Form method="post">
-            <input type="hidden" name="participantIds" value={participantIds} />
 
             <Table>
               <TableHeader>