Return 404 for non-numeric like and bookmark IDs #147

Merged
jonny merged 1 commit from fix-non-numeric-route-ids into develop 2026-10-29 20:10:20 +01:00
Owner

Fixes a Flare error (#9528114): a request to /likes/twcamp^share|twsrc^ios|twgr^software.studioh.Indigenous.share-micropub" returned a 500.

The likes/{like} route used route model binding with no constraint, so the junk segment ended up in where "id" = '...'. Postgres rejects comparing text to an integer column (SQLSTATE 22P02), which caused the 500. bookmarks/{bookmark} had the same problem.

Changes

  • Constrain both routes with ->whereNumber(...), so non-numeric IDs now return a 404.
  • Add a regression test for each route. Both tests fail without the route change and pass with it. The full suite passes (386 tests).

Likes and bookmarks only ever generate numeric URLs (/likes/{id}, Bookmark::localUri()). They don't use newbase60 like notes do, so no real links are affected.

🤖 Generated with Claude Code

Fixes a Flare error (#9528114): a request to `/likes/twcamp^share|twsrc^ios|twgr^software.studioh.Indigenous.share-micropub"` returned a 500. The `likes/{like}` route used route model binding with no constraint, so the junk segment ended up in `where "id" = '...'`. Postgres rejects comparing text to an integer column (SQLSTATE 22P02), which caused the 500. `bookmarks/{bookmark}` had the same problem. ## Changes - Constrain both routes with `->whereNumber(...)`, so non-numeric IDs now return a 404. - Add a regression test for each route. Both tests fail without the route change and pass with it. The full suite passes (386 tests). Likes and bookmarks only ever generate numeric URLs (`/likes/{id}`, `Bookmark::localUri()`). They don't use newbase60 like notes do, so no real links are affected. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Constrain the likes/{like} and bookmarks/{bookmark} routes to numeric
IDs. Previously a junk URL such as /likes/twcamp^share|twsrc^ios was
passed to route model binding, and Postgres rejected the text-vs-integer
comparison with a QueryException, returning a 500 instead of a 404.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jonny merged commit 7ce256baa5 into develop 2026-10-29 20:10:20 +01:00
jonny deleted branch fix-non-numeric-route-ids 2026-10-29 20:10:20 +01:00
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jonny/jonnybarnes.uk!147
No description provided.