fix: MEDIUM issues #31-#36 — inline text editor, image/paste persist, input validation on all routes, useEffect deps, online count fix

backend/src/routes/users.ts

@@ -4,6 +4,7 @@
 import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
 import type { DatabaseInterface, DBUser } from '../database/DatabaseInterface.js';
 import type { AuthService } from '../auth/AuthService.js';
+import { validateIdParam } from '../utils/validation.js';
 
 function extractToken(request: FastifyRequest): string | null {
   const auth = request.headers?.authorization;
@@ -43,6 +44,8 @@ export function registerUserRoutes(fastify: FastifyInstance, db: DatabaseInterfa
   fastify.get('/api/users/:id', async (request, reply) => {
     if (!requireAdmin(request, reply, authService)) return;
     const { id } = request.params as { id: string };
+    const idErr = validateIdParam(id, 'id');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const user = db.getUser(id);
     if (!user) return reply.code(404).send({ error: 'User not found' });
     const { password_hash, ...safe } = user;
@@ -53,6 +56,8 @@ export function registerUserRoutes(fastify: FastifyInstance, db: DatabaseInterfa
   fastify.patch('/api/users/:id', async (request, reply) => {
     if (!requireAdmin(request, reply, authService)) return;
     const { id } = request.params as { id: string };
+    const idErr = validateIdParam(id, 'id');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const body = request.body as Partial<DBUser>;
     // Prevent password update via this endpoint
     delete body.password_hash;
@@ -66,6 +71,8 @@ export function registerUserRoutes(fastify: FastifyInstance, db: DatabaseInterfa
   fastify.delete('/api/users/:id', async (request, reply) => {
     if (!requireAdmin(request, reply, authService)) return;
     const { id } = request.params as { id: string };
+    const idErr = validateIdParam(id, 'id');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const ok = db.deleteUser(id);
     if (!ok) return reply.code(404).send({ error: 'User not found' });
     return reply.code(204).send();