fix: harden input validation, redirect safety, and error resilience

src/action-routes.ts

@@ -2,6 +2,7 @@ import { Hono } from "hono";
 import { getUserOctokit } from "./github-oauth";
 import { findUserIdByToken } from "./token-store";
 import type { Env } from "./types";
+import { log } from "./log";
 
 function extractBearerToken(c: {
   req: { header: (name: string) => string | undefined };
@@ -11,6 +12,24 @@ function extractBearerToken(c: {
   return auth.slice(7);
 }
 
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === "string" && value.length > 0;
+}
+
+function isValidId(value: unknown): value is number {
+  return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+
+async function readJson(c: {
+  req: { json: <T>() => Promise<T> };
+}): Promise<Record<string, unknown> | null> {
+  try {
+    return (await c.req.json()) as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+}
+
 export function createActionRoutes(): Hono<{ Bindings: Env }> {
   const app = new Hono<{ Bindings: Env }>();
 
@@ -20,21 +39,30 @@ export function createActionRoutes(): Hono<{ Bindings: Env }> {
     const userId = await findUserIdByToken(c.env.KV, token);
     if (!userId) return c.json({ error: "Invalid or expired token" }, 401);
 
-    const body = await c.req.json<{
-      owner: string;
-      repo: string;
-      issueNumber: number;
-      body: string;
-    }>();
+    const body = await readJson(c);
+    if (
+      !body ||
+      !isNonEmptyString(body.owner) ||
+      !isNonEmptyString(body.repo) ||
+      !isValidId(body.issueNumber) ||
+      !isNonEmptyString(body.body)
+    ) {
+      return c.json({ error: "Invalid request body" }, 400);
+    }
     const octokit = await getUserOctokit(userId, c.env.KV);
     if (!octokit) return c.json({ error: "Not authorized" }, 401);
 
-    await octokit.rest.issues.createComment({
-      owner: body.owner,
-      repo: body.repo,
-      issue_number: body.issueNumber,
-      body: body.body,
-    });
+    try {
+      await octokit.rest.issues.createComment({
+        owner: body.owner,
+        repo: body.repo,
+        issue_number: body.issueNumber,
+        body: body.body,
+      });
+    } catch (err) {
+      log.error({ err }, "Failed to create comment");
+      return c.json({ error: "GitHub API error" }, 500);
+    }
 
     return c.json({ ok: true });
   });
@@ -45,21 +73,33 @@ export function createActionRoutes(): Hono<{ Bindings: Env }> {
     const userId = await findUserIdByToken(c.env.KV, token);
     if (!userId) return c.json({ error: "Invalid or expired token" }, 401);
 
-    const body = await c.req.json<{
-      owner: string;
-      repo: string;
-      pullNumber: number;
-      method?: "merge" | "squash" | "rebase";
-    }>();
+    const body = await readJson(c);
+    if (
+      !body ||
+      !isNonEmptyString(body.owner) ||
+      !isNonEmptyString(body.repo) ||
+      !isValidId(body.pullNumber)
+    ) {
+      return c.json({ error: "Invalid request body" }, 400);
+    }
+    const method = body.method === undefined ? "squash" : body.method;
+    if (method !== "merge" && method !== "squash" && method !== "rebase") {
+      return c.json({ error: "Invalid request body" }, 400);
+    }
     const octokit = await getUserOctokit(userId, c.env.KV);
     if (!octokit) return c.json({ error: "Not authorized" }, 401);
 
-    await octokit.rest.pulls.merge({
-      owner: body.owner,
-      repo: body.repo,
-      pull_number: body.pullNumber,
-      merge_method: body.method ?? "squash",
-    });
+    try {
+      await octokit.rest.pulls.merge({
+        owner: body.owner,
+        repo: body.repo,
+        pull_number: body.pullNumber,
+        merge_method: method,
+      });
+    } catch (err) {
+      log.error({ err }, "Failed to merge pull request");
+      return c.json({ error: "GitHub API error" }, 500);
+    }
 
     return c.json({ ok: true });
   });
@@ -70,20 +110,29 @@ export function createActionRoutes(): Hono<{ Bindings: Env }> {
     const userId = await findUserIdByToken(c.env.KV, token);
     if (!userId) return c.json({ error: "Invalid or expired token" }, 401);
 
-    const body = await c.req.json<{
-      owner: string;
-      repo: string;
-      pullNumber: number;
-    }>();
+    const body = await readJson(c);
+    if (
+      !body ||
+      !isNonEmptyString(body.owner) ||
+      !isNonEmptyString(body.repo) ||
+      !isValidId(body.pullNumber)
+    ) {
+      return c.json({ error: "Invalid request body" }, 400);
+    }
     const octokit = await getUserOctokit(userId, c.env.KV);
     if (!octokit) return c.json({ error: "Not authorized" }, 401);
 
-    await octokit.rest.pulls.update({
-      owner: body.owner,
-      repo: body.repo,
-      pull_number: body.pullNumber,
-      state: "closed",
-    });
+    try {
+      await octokit.rest.pulls.update({
+        owner: body.owner,
+        repo: body.repo,
+        pull_number: body.pullNumber,
+        state: "closed",
+      });
+    } catch (err) {
+      log.error({ err }, "Failed to close pull request");
+      return c.json({ error: "GitHub API error" }, 500);
+    }
 
     return c.json({ ok: true });
   });
@@ -94,22 +143,40 @@ export function createActionRoutes(): Hono<{ Bindings: Env }> {
     const userId = await findUserIdByToken(c.env.KV, token);
     if (!userId) return c.json({ error: "Invalid or expired token" }, 401);
 
-    const body = await c.req.json<{
-      owner: string;
-      repo: string;
-      issueNumber: number;
-      reaction: string;
-    }>();
+    const body = await readJson(c);
+    const reactions = ["+1", "-1", "laugh", "confused", "heart", "hooray", "rocket", "eyes"] as const;
+    if (
+      !body ||
+      !isNonEmptyString(body.owner) ||
+      !isNonEmptyString(body.repo) ||
+      !isValidId(body.issueNumber) ||
+      !isNonEmptyString(body.reaction) ||
+      !(reactions as readonly string[]).includes(body.reaction)
+    ) {
+      return c.json({ error: "Invalid request body" }, 400);
+    }
     const octokit = await getUserOctokit(userId, c.env.KV);
     if (!octokit) return c.json({ error: "Not authorized" }, 401);
 
-    await octokit.rest.reactions.createForIssue({
-      owner: body.owner,
-      repo: body.repo,
-      issue_number: body.issueNumber,
-      content: body.reaction as
-        "+1" | "-1" | "laugh" | "confused" | "heart" | "hooray" | "rocket" | "eyes",
-    });
+    try {
+      await octokit.rest.reactions.createForIssue({
+        owner: body.owner,
+        repo: body.repo,
+        issue_number: body.issueNumber,
+        content: body.reaction as
+          | "+1"
+          | "-1"
+          | "laugh"
+          | "confused"
+          | "heart"
+          | "hooray"
+          | "rocket"
+          | "eyes",
+      });
+    } catch (err) {
+      log.error({ err }, "Failed to create reaction");
+      return c.json({ error: "GitHub API error" }, 500);
+    }
 
     return c.json({ ok: true });
   });