fix(admin): restore digit match in discordId route validation #96

wtclaude · 2026-07-22T18:01:39Z

wtclaude commented

2026-07-22 18:01:39 +00:00

Problem

The :discordId param validator on the admin moderation routes uses /^d{1,32}$/, which matches 1–32 literal d characters, not digits. A real numeric Discord snowflake (e.g. 123456789012345678) fails validation, so every /moderation/user/:discordId* endpoint returns 400 for valid input. This is live in main and deployed.

Affected routes (all 5 occurrences in admin.routes.js):

GET /moderation/user/:discordId
GET /moderation/user/:discordId/actions
GET /moderation/user/:discordId/notes
POST /moderation/user/:discordId/notes
GET /moderation/user/:discordId/appeals

Cause

The backslash was dropped in a prior code-smell cleanup (12d50fd, "resolve SonarQube code smells") that intended to rewrite [0-9] → \d but produced d.

Fix

Restore \d so the regex matches digits again.

- param('discordId').matches(/^d{1,32}$/),
+ param('discordId').matches(/^\d{1,32}$/),

Verified: /^\d{1,32}$/ accepts 123456789012345678, rejects ddd, empty, and 33-digit overflow. No Swagger regen needed (the regex is not part of the #swagger.* annotations). No other dropped-backslash regexes exist elsewhere in server/, client/, or bot/.

AI-assisted: this change was authored with Claude Code.

🤖 Generated with Claude Code

## Problem The `:discordId` param validator on the admin moderation routes uses `/^d{1,32}$/`, which matches 1–32 **literal `d` characters**, not digits. A real numeric Discord snowflake (e.g. `123456789012345678`) fails validation, so **every `/moderation/user/:discordId*` endpoint returns `400` for valid input**. This is live in `main` and deployed. Affected routes (all 5 occurrences in `admin.routes.js`): - `GET /moderation/user/:discordId` - `GET /moderation/user/:discordId/actions` - `GET /moderation/user/:discordId/notes` - `POST /moderation/user/:discordId/notes` - `GET /moderation/user/:discordId/appeals` ## Cause The backslash was dropped in a prior code-smell cleanup (`12d50fd`, "resolve SonarQube code smells") that intended to rewrite `[0-9]` → `\d` but produced `d`. ## Fix Restore `\d` so the regex matches digits again. ``` - param('discordId').matches(/^d{1,32}$/), + param('discordId').matches(/^\d{1,32}$/), ``` Verified: `/^\d{1,32}$/` accepts `123456789012345678`, rejects `ddd`, empty, and 33-digit overflow. No Swagger regen needed (the regex is not part of the `#swagger.*` annotations). No other dropped-backslash regexes exist elsewhere in `server/`, `client/`, or `bot/`. --- AI-assisted: this change was authored with Claude Code. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

wtclaude added 1 commit 2026-07-22 18:01:40 +00:00

fix(admin): restore digit match in discordId route validation

PR Checks / bot-install (pull_request) Successful in 17s

Details

PR Checks / client-build (pull_request) Successful in 25s

Details

PR Checks / server-tests (pull_request) Successful in 9m30s

Details

e08c0c9736

The `:discordId` param validator on the five admin moderation routes used
`/^d{1,32}$/`, which matches 1-32 literal `d` characters instead of digits.
A real numeric Discord snowflake failed validation, so every
`/moderation/user/:discordId*` endpoint returned a 400 for valid input.

The backslash was dropped in a prior code-smell cleanup (12d50fd) that
intended `[0-9]` -> `\d`. Restore `\d` so the regex matches digits again.

Co-Authored-By: Claude <noreply@anthropic.com>

whitlocktech approved these changes 2026-07-22 18:02:41 +00:00

whitlocktech scheduled this pull request to auto merge when all checks succeed 2026-07-22 18:02:51 +00:00

whitlocktech merged commit bcdba4ce0a into main

2026-07-22 18:11:44 +00:00

whitlocktech deleted branch fix/discord-id-validation-regex

2026-07-22 18:11:44 +00:00

whitlocktech referenced this issue from a commit

2026-07-22 18:11:45 +00:00

Merge pull request 'fix(admin): restore digit match in discordId route validation' (#96) from fix/discord-id-validation-regex into main

wtclaude referenced this pull request

2026-07-22 18:14:20 +00:00

fix(moderation): windowValue must not fall back to the 30d total on a null column #97