bulltrackers-module 1.0.621 → 1.0.623

package/functions/api-v2/routes/settings.js

@@ -1,27 +1,53 @@
 const express = require('express');
+const { z } = require('zod');
 const { manageNotificationPreferences, isDeveloper, sendTestAlert } = require('../helpers/data-fetchers/firestore.js');
 
 const router = express.Router();
 
+// Input validation schemas
+const notificationPreferencesSchema = z.object({
+    email: z.boolean().optional(),
+    push: z.boolean().optional(),
+    sms: z.boolean().optional(),
+    alertTypes: z.record(z.boolean()).optional(),
+    thresholds: z.record(z.any()).optional()
+});
+
+const devOverrideSchema = z.object({
+    enabled: z.boolean(),
+    impersonateCid: z.union([z.string().regex(/^\d+$/), z.number().int().positive()]).optional(),
+    fakeCopiedPIs: z.array(z.union([z.string().regex(/^\d+$/), z.number().int().positive()])).optional()
+});
+
 // GET /settings/notifications
-router.get('/notifications', async (req, res) => {
+router.get('/notifications', async (req, res, next) => {
     try {
         const { db } = req.dependencies;
         const data = await manageNotificationPreferences(db, req.targetUserId, 'get');
         res.json({ success: true, data });
     } catch (error) {
-        res.status(500).json({ error: error.message });
+        next(error);
     }
 });
 
 // PUT /settings/notifications
-router.put('/notifications', async (req, res) => {
+router.put('/notifications', async (req, res, next) => {
     try {
+        // Validate input
+        const validated = notificationPreferencesSchema.parse(req.body);
+        
         const { db } = req.dependencies;
-        const result = await manageNotificationPreferences(db, req.targetUserId, 'update', req.body);
+        const result = await manageNotificationPreferences(db, req.targetUserId, 'update', validated);
         res.json(result);
     } catch (error) {
-        res.status(500).json({ error: error.message });
+        if (error instanceof z.ZodError) {
+            return res.status(400).json({ 
+                success: false,
+                error: 'Invalid input', 
+                details: error.errors 
+            });
+        }
+        next(error);
     }
 });
 
@@ -33,27 +59,39 @@ router.get('/dev/override', async (req, res) => {
 
         const doc = await db.collection('dev_overrides').doc(req.targetUserId).get();
         res.json({ success: true, data: doc.exists ? doc.data() : { enabled: false } });
-    } catch (e) { res.status(500).json({ error: e.message }); }
+    } catch (e) { next(e); }
 });
 
 // POST /settings/dev/override
-router.post('/dev/override', async (req, res) => {
+router.post('/dev/override', async (req, res, next) => {
     try {
-        const { db } = req.dependencies;
-        const { enabled, impersonateCid, fakeCopiedPIs } = req.body;
+        // Validate input
+        const validated = devOverrideSchema.parse(req.body);
         
-        if (!(await isDeveloper(db, req.targetUserId))) return res.status(403).json({ error: "Unauthorized" });
+        const { db } = req.dependencies;
+        if (!(await isDeveloper(db, req.targetUserId))) {
+            const error = new Error("Unauthorized");
+            error.status = 403;
+            return next(error);
+        }
 
         await db.collection('dev_overrides').doc(req.targetUserId).set({
-            enabled,
-            impersonateCid,
-            fakeCopiedPIs: fakeCopiedPIs || [],
+            enabled: validated.enabled,
+            impersonateCid: validated.impersonateCid ? String(validated.impersonateCid) : undefined,
+            fakeCopiedPIs: validated.fakeCopiedPIs ? validated.fakeCopiedPIs.map(cid => String(cid)) : [],
             updatedAt: new Date()
         }, { merge: true });
 
         res.json({ success: true, message: "Dev override updated" });
     } catch (error) {
-        res.status(500).json({ error: error.message });
+        if (error instanceof z.ZodError) {
+            return res.status(400).json({ 
+                success: false,
+                error: 'Invalid input', 
+                details: error.errors 
+            });
+        }
+        next(error);
     }
 });
 

package/functions/api-v2/routes/sync.js

@@ -1,4 +1,5 @@
 const express = require('express');
+const { z } = require('zod');
 const { dispatchSyncRequest } = require('../helpers/task_engine_helper.js'); 
 const { 
     checkSyncRateLimits, 
@@ -10,22 +11,58 @@ const {
     checkDataStatus,
     checkPopularInvestorDataStatus
 } = require('../helpers/data-fetchers/firestore.js');
+const { sanitizeCid } = require('../helpers/security_utils.js');
 
 const router = express.Router();
 
+// Input validation schemas
+const syncRequestSchema = z.object({
+    targetId: z.union([
+        z.string().regex(/^\d+$/, 'Invalid CID format'),
+        z.number().int().positive()
+    ]).optional()
+}).transform(data => ({
+    ...data,
+    targetId: data.targetId ? String(data.targetId) : undefined
+}));
+
 // Helper function for sync request logic (shared between /sync/request and /user/:userId/sync)
-const handleSyncRequest = async (req, res) => {
+const handleSyncRequest = async (req, res, next) => {
     try {
         const { pubsub, db } = req.dependencies;
-        // targetId can be passed (for PIs) or default to self
-        // For /user/:userId/sync, targetId comes from URL param
-        // For /sync/request, targetId comes from body or req.targetUserId
-        const targetId = req.body.targetId || req.params.userId || req.targetUserId;
         
-        // 1. Rate Limits
+        // Validate and sanitize input
+        let targetId;
+        if (req.params.userId) {
+            // From URL param - sanitize directly
+            targetId = sanitizeCid(req.params.userId);
+        } else if (req.body.targetId) {
+            // From body - validate with schema
+            const validated = syncRequestSchema.parse({ targetId: req.body.targetId });
+            targetId = validated.targetId || sanitizeCid(req.targetUserId);
+        } else {
+            // Default to authenticated user
+            targetId = sanitizeCid(req.targetUserId);
+        }
+        
+        // 1. Rate Limits with developer audit logging
         const isDev = await isDeveloper(db, req.targetUserId);
         const limit = await checkSyncRateLimits(db, targetId, req.targetUserId, isDev);
-        if (!limit.allowed) return res.status(429).json({ error: limit.message });
+        
+        // Log developer activity for audit trail
+        if (isDev) {
+            console.log(`[Sync Rate Limit] Developer ${req.targetUserId} sync request for target ${targetId}`, {
+                timestamp: new Date().toISOString(),
+                developerCid: req.targetUserId,
+                targetCid: targetId,
+                ip: req.ip,
+                allowed: limit.allowed
+            });
+        }
+        
+        if (!limit.allowed) {
+            return res.status(429).json({ error: limit.message });
+        }
 
         // 2. Detect User Types (needed for validation)
         const [isSignedIn, isPI] = await Promise.all([
@@ -156,7 +193,7 @@ const handleSyncRequest = async (req, res) => {
             message: `Sync dispatched for ${isSignedIn && isPI ? 'both user types' : isSignedIn ? 'signed-in user' : 'popular investor'}` 
         });
     } catch (error) {
-        res.status(500).json({ error: error.message });
+        next(error);
     }
 };
 
@@ -167,7 +204,9 @@ router.post('/request', handleSyncRequest);
 router.get('/status/:targetId', async (req, res, next) => {
     try {
         const { db } = req.dependencies;
-        const status = await getSyncStatus(db, req.params.targetId);
+        // Sanitize targetId from URL param
+        const targetId = sanitizeCid(req.params.targetId);
+        const status = await getSyncStatus(db, targetId);
         res.json({ success: true, data: status });
     } catch (error) {
         next(error);

package/functions/api-v2/routes/watchlists.js

@@ -1,4 +1,5 @@
 const express = require('express');
+const { z } = require('zod');
 const { 
     manageUserWatchlist, 
     latestUserCentricSnapshot, 
@@ -11,11 +12,29 @@ const {
     getWatchlistTriggerCounts,
     subscribeToAllWatchlistPIs
 } = require('../helpers/data-fetchers/firestore.js');
+const { sanitizeDocId } = require('../helpers/security_utils.js');
 
 const router = express.Router();
 
+// Input validation schemas
+const watchlistManageSchema = z.object({
+    instruction: z.enum(['create', 'update', 'delete', 'add_item', 'remove_item', 'update_item']),
+    payload: z.object({
+        watchlistId: z.string().optional(),
+        name: z.string().max(200).optional(),
+        description: z.string().max(1000).optional(),
+        items: z.array(z.any()).optional(),
+        item: z.any().optional()
+    })
+});
+
+const watchlistSubscribeSchema = z.object({
+    alertTypes: z.array(z.string()).optional(),
+    thresholds: z.record(z.any()).optional()
+});
+
 // GET /watchlists/all
-router.get('/all', async (req, res) => {
+router.get('/all', async (req, res, next) => {
     try {
         const { db } = req.dependencies;
         const watchlists = await latestUserCentricSnapshot(db, req.targetUserId, 'watchlists', 'watchlist', 'SignedInUsers', null);
@@ -36,9 +55,12 @@ router.post('/auto-generate', async (req, res, next) => {
 });
 
 // GET /watchlists/public - Must be before /:id route to avoid route conflict
-router.get('/public', async (req, res) => {
+router.get('/public', async (req, res, next) => {
     try {
-        const data = await fetchPublicWatchlists(req.dependencies.db, req.query.limit, req.query.offset);
+        // Validate and sanitize query parameters
+        const limit = req.query.limit ? Math.min(Math.max(parseInt(req.query.limit) || 10, 1), 100) : 10;
+        const offset = req.query.offset ? Math.max(parseInt(req.query.offset) || 0, 0) : 0;
+        const data = await fetchPublicWatchlists(req.dependencies.db, limit, offset);
         res.json({ success: true, data });
     } catch (e) { next(e); }
 });
@@ -47,9 +69,14 @@ router.get('/public', async (req, res) => {
 router.get('/:id', async (req, res, next) => {
     try {
         const { db } = req.dependencies;
-        const { id } = req.params;
+        // Sanitize watchlist ID
+        const id = sanitizeDocId(req.params.id);
         const doc = await latestUserCentricSnapshot(db, req.targetUserId, 'watchlists', 'watchlist', 'SignedInUsers', id);
-        if (!doc) return res.status(404).json({ error: "Watchlist not found" });
+        if (!doc) {
+            const error = new Error("Watchlist not found");
+            error.status = 404;
+            return next(error);
+        }
         res.json({ success: true, data: doc });
     } catch (error) {
         next(error);
@@ -57,24 +84,37 @@ router.get('/:id', async (req, res, next) => {
 });
 
 // GET /watchlists/:id/rankings-check (Rec 10)
-router.get('/:id/rankings-check', async (req, res) => {
+router.get('/:id/rankings-check', async (req, res, next) => {
     try {
         const { db } = req.dependencies;
-        const { id } = req.params;
+        // Sanitize watchlist ID
+        const id = sanitizeDocId(req.params.id);
         
         // Fetch watchlist
         const wl = await latestUserCentricSnapshot(db, req.targetUserId, 'watchlists', 'watchlist', 'SignedInUsers', id);
-        if (!wl) return res.status(404).json({ error: "Watchlist not found" });
+        if (!wl) {
+            const error = new Error("Watchlist not found");
+            error.status = 404;
+            return next(error);
+        }
 
-        const results = {};
-        for (const item of (wl.items || [])) {
+        // Parallelize PI checks to avoid N+1 queries
+        const items = wl.items || [];
+        const checkPromises = items.map(async (item) => {
             try {
                 await fetchPopularInvestorMasterList(db, String(item.cid));
-                results[item.cid] = true;
+                return { cid: item.cid, exists: true };
             } catch {
-                results[item.cid] = false;
+                return { cid: item.cid, exists: false };
             }
-        }
+        });
+        
+        const checkResults = await Promise.all(checkPromises);
+        const results = {};
+        checkResults.forEach(result => {
+            results[result.cid] = result.exists;
+        });
+        
         res.json({ success: true, data: results });
     } catch (error) {
         next(error);
@@ -84,11 +124,20 @@ router.get('/:id/rankings-check', async (req, res) => {
 // POST /watchlists/manage (Unified)
 router.post('/manage', async (req, res, next) => {
     try {
+        // Validate input
+        const validatedData = watchlistManageSchema.parse(req.body);
+        
         const { db } = req.dependencies;
-        const { instruction, payload } = req.body; 
-        const result = await manageUserWatchlist(db, req.targetUserId, instruction, payload);
+        const result = await manageUserWatchlist(db, req.targetUserId, validatedData.instruction, validatedData.payload);
         res.json(result);
     } catch (error) {
+        if (error instanceof z.ZodError) {
+            return res.status(400).json({ 
+                success: false,
+                error: 'Invalid input', 
+                details: error.errors 
+            });
+        }
         next(error);
     }
 });
@@ -96,53 +145,71 @@ router.post('/manage', async (req, res, next) => {
 // Public & Copy Routes (Existing)
 router.post('/:id/publish', async (req, res, next) => {
     try {
-        const result = await publishWatchlistVersion(req.dependencies.db, req.targetUserId, req.params.id);
+        // Sanitize watchlist ID
+        const id = sanitizeDocId(req.params.id);
+        const result = await publishWatchlistVersion(req.dependencies.db, req.targetUserId, id);
         res.json(result);
     } catch (e) { next(e); }
 });
 
-router.post('/:id/copy', async (req, res) => {
+router.post('/:id/copy', async (req, res, next) => {
     try {
-        const result = await copyWatchlist(req.dependencies.db, req.targetUserId, req.params.id, req.body.version);
+        // Sanitize watchlist ID
+        const id = sanitizeDocId(req.params.id);
+        const version = req.body.version ? sanitizeDocId(String(req.body.version)) : undefined;
+        const result = await copyWatchlist(req.dependencies.db, req.targetUserId, id, version);
         res.json(result);
     } catch (e) { next(e); }
 });
 
 router.get('/:id/versions', async (req, res, next) => {
     try {
-        const data = await fetchWatchlistVersions(req.dependencies.db, req.params.id);
+        // Sanitize watchlist ID
+        const id = sanitizeDocId(req.params.id);
+        const data = await fetchWatchlistVersions(req.dependencies.db, id);
         res.json({ success: true, data });
     } catch (e) { next(e); }
 });
 
 // GET /watchlists/:id/trigger-counts - Get alert trigger counts for watchlist PIs
-router.get('/:id/trigger-counts', async (req, res) => {
+router.get('/:id/trigger-counts', async (req, res, next) => {
     try {
         const { db } = req.dependencies;
-        const { id } = req.params;
+        // Sanitize watchlist ID
+        const id = sanitizeDocId(req.params.id);
         const result = await getWatchlistTriggerCounts(db, req.targetUserId, id);
         res.json({ success: true, ...result });
     } catch (error) {
         if (error.message === "Watchlist not found") {
             error.status = 404;
         }
-        res.status(500).json({ error: error.message });
+        next(error);
     }
 });
 
 // POST /watchlists/:id/subscribe-all - Subscribe to all PIs in a watchlist
 router.post('/:id/subscribe-all', async (req, res, next) => {
     try {
+        // Validate input
+        const validatedData = watchlistSubscribeSchema.parse(req.body);
+        // Sanitize watchlist ID
+        const id = sanitizeDocId(req.params.id);
+        
         const { db } = req.dependencies;
-        const { id } = req.params;
-        const { alertTypes, thresholds } = req.body;
-        const result = await subscribeToAllWatchlistPIs(db, req.targetUserId, id, alertTypes, thresholds);
+        const result = await subscribeToAllWatchlistPIs(db, req.targetUserId, id, validatedData.alertTypes, validatedData.thresholds);
         res.json(result);
     } catch (error) {
+        if (error instanceof z.ZodError) {
+            return res.status(400).json({ 
+                success: false,
+                error: 'Invalid input', 
+                details: error.errors 
+            });
+        }
         if (error.message === "Watchlist not found") {
             error.status = 404;
         }
-        res.status(500).json({ error: error.message });
+        next(error);
     }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bulltrackers-module",
-  "version": "1.0.621",
+  "version": "1.0.623",
   "description": "Helper Functions for Bulltrackers.",
   "main": "index.js",
   "files": [