fix: MEDIUM issues #31-#36 — inline text editor, image/paste persist, input validation on all routes, useEffect deps, online count fix

backend/src/routes/projects.ts

@@ -5,6 +5,7 @@ import type { FastifyInstance } from 'fastify';
 import type { DatabaseInterface, DBProject } from '../database/DatabaseInterface.js';
 import { requireAuth } from '../auth/authMiddleware.js';
 import type { AuthService } from '../auth/AuthService.js';
+import { validateName, validateIdParam } from '../utils/validation.js';
 
 export function registerProjectRoutes(fastify: FastifyInstance, db: DatabaseInterface, authService: AuthService) {
   // List projects owned by the authenticated user
@@ -18,6 +19,8 @@ export function registerProjectRoutes(fastify: FastifyInstance, db: DatabaseInte
   fastify.get('/api/projects/:id', async (request, reply) => {
     if (!requireAuth(request, reply, authService)) return;
     const { id } = request.params as { id: string };
+    const idErr = validateIdParam(id, 'id');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const project = db.getProject(id);
     if (!project) return reply.code(404).send({ error: 'Project not found' });
     return project;
@@ -28,7 +31,8 @@ export function registerProjectRoutes(fastify: FastifyInstance, db: DatabaseInte
     const user = requireAuth(request, reply, authService);
     if (!user) return;
     const body = request.body as Partial<DBProject>;
-    if (!body.name) return reply.code(400).send({ error: 'Name is required' });
+    const nameErr = validateName(body.name);
+    if (nameErr) return reply.code(400).send({ error: nameErr });
     return reply.code(201).send(db.createProject({ ...body, owner_id: user.id }));
   });
 
@@ -36,7 +40,13 @@ export function registerProjectRoutes(fastify: FastifyInstance, db: DatabaseInte
   fastify.patch('/api/projects/:id', async (request, reply) => {
     if (!requireAuth(request, reply, authService)) return;
     const { id } = request.params as { id: string };
+    const idErr = validateIdParam(id, 'id');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const body = request.body as Partial<DBProject>;
+    if (body.name !== undefined) {
+      const nameErr = validateName(body.name);
+      if (nameErr) return reply.code(400).send({ error: nameErr });
+    }
     const updated = db.updateProject(id, body);
     if (!updated) return reply.code(404).send({ error: 'Project not found' });
     return updated;
@@ -46,6 +56,8 @@ export function registerProjectRoutes(fastify: FastifyInstance, db: DatabaseInte
   fastify.delete('/api/projects/:id', async (request, reply) => {
     if (!requireAuth(request, reply, authService)) return;
     const { id } = request.params as { id: string };
+    const idErr = validateIdParam(id, 'id');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const ok = db.deleteProject(id);
     if (!ok) return reply.code(404).send({ error: 'Project not found' });
     return reply.code(204).send();