mars MARS-163

Sweep: uuid-format guard on all [id] resource routes (comisiones/docentes/alumnos/periodos/solicitudes/soporte/usuarios) — a non-uuid id casts into a uuid-typed query → 'invalid input syntax for type uuid' → unhandled 500 before missing/deleted handling runs (same latent defect found+fixed on practicas via MARS-155). Mirror the practicas data-layer guard (return null on non-uuid → existing friendly not-available path) or a shared isUuid() helper across all resource routes. Reversible per-route guard.

Done normal smsolo-mars-cc

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Questions

No questions.

Activity

wi-cli-venus created · 2026-06-21
wi-cli-venus assigned · 6w ago

solo-mars-cc
wi-cli-venus statusChanged · 6w ago

shakedown test: solo-mars-cc runs full loop alone; coder+db+audit cross-review after
wi-cli-venus commented · 6w ago

Scope expanded (PM go): WI premise was wrong - MARS-155 shipped only a 404-logging classifier (UUID_RE in not-found-classify.ts, unexported); getPracticaDetail has NO data-layer uuid guard, authed /practicas/[id] still 500s on malformed id (solo verified 22P02 on prod). Sweep now = shared isUuid() helper + guard ALL [id] routes incl. /practicas/[id] + /mi-cursada/[id].
wi-cli-venus commented · 6w ago

solo-mars-cc consolidated result: SHA 71ed12a v2.23.14 live. Shared isUuid() (src/lib/format.ts) + hybrid guards: data-layer null-return (getPracticaDetail/getComisionHeader/getComisionDetail/getPeriodoDetail/getUserDetail/getUserAccessoData) + page-level early guards (comisiones, alumnos, soporte x2, solicitudes, mi-cursada/editar). 12 files +40/-4, all 14 [id] pages covered. Self-PTD: version 2.23.14 live, DB-level 22P02 repro proves guard, unauth curls 307 (authed path marked not-exercised, proven via DB repro), zero runtime/appEvents errors. Flagged out-of-scope: /api/image/[id] raw bind but try/catch-wrapped. Cross-review dispatched: coder (code/completeness), db (DB claims), audit (PTD rigor + PASS/BLOCK).
wi-cli-venus commented · 6w ago

db-mars-cc cross-review PASS: 22P02 claim verified live; /api/image/[id] not a gap (own IMAGE_ID_PATTERN pre-query guard + try/catch); administrar redirect-shims no-query no-risk; zero app-triggered 22P02 since deploy (only manual psql verification entries).
wi-cli-venus commented · 6w ago

coder-mars-cc cross-review PASS: verified all 17 dynamic page.tsx (beyond the 14 claimed) - transitive getUserDetail coverage accurate, redirect stubs + slug routes correctly skipped, practicas inline query safe by ordering, no missed callers, regex correctly permissive. One cosmetic nit: isUuid placed after cap-gate in getUserDetail/getUserAccessoData vs first-line elsewhere (non-blocking).
wi-cli-venus completed · 6w ago

uuid-format guard sweep shipped by solo-mars-cc (shakedown test): shared isUuid() + hybrid data-layer/page guards, all 17 dynamic [id] pages covered, SHA 71ed12a v2.23.14 live. Cross-review: coder PASS, db PASS, audit PASS:71ed12a. Found+fixed false WI premise (practicas was never data-layer guarded).