fix: MEDIUM issues #31-#36 — inline text editor, image/paste persist, input validation on all routes, useEffect deps, online count fix

backend/src/routes/shares.ts

@@ -4,6 +4,7 @@
 import type { FastifyInstance } from 'fastify';
 import type { DatabaseInterface } from '../database/DatabaseInterface.js';
 import type { AuthService } from '../auth/AuthService.js';
+import { validateIdParam } from '../utils/validation.js';
 
 function extractToken(request: any): string | null {
   const auth = request.headers?.authorization;
@@ -21,6 +22,8 @@ export function registerShareRoutes(fastify: FastifyInstance, db: DatabaseInterf
     const user = authService.getUserFromSession(token);
     if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
     const { projectId } = request.params as { projectId: string };
+    const projIdErr = validateIdParam(projectId, 'projectId');
+    if (projIdErr) return reply.code(400).send({ error: projIdErr });
     const project = db.getProject(projectId);
     if (!project) return reply.code(404).send({ error: 'Project not found' });
     if (project.owner_id !== user.id) return reply.code(403).send({ error: 'Forbidden' });
@@ -34,6 +37,8 @@ export function registerShareRoutes(fastify: FastifyInstance, db: DatabaseInterf
     const user = authService.getUserFromSession(token);
     if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
     const { projectId } = request.params as { projectId: string };
+    const projIdErr = validateIdParam(projectId, 'projectId');
+    if (projIdErr) return reply.code(400).send({ error: projIdErr });
     const project = db.getProject(projectId);
     if (!project) return reply.code(404).send({ error: 'Project not found' });
     if (project.owner_id !== user.id) return reply.code(403).send({ error: 'Forbidden' });
@@ -69,6 +74,8 @@ export function registerShareRoutes(fastify: FastifyInstance, db: DatabaseInterf
     const user = authService.getUserFromSession(token);
     if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
     const { id } = request.params as { id: string };
+    const idErr = validateIdParam(id, 'id');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const share = db.getProjectShare(id);
     if (!share) return reply.code(404).send({ error: 'Share not found' });
     const project = db.getProject(share.project_id);