safe-global / safe-client-gateway / 35326615641

89%

push

github

fix: reject an empty chainId instead of returning 502 (#3397)

* fix(messages): reject an empty chainId instead of returning 502

An empty `chainId` path segment still matches the message routes, and the
unvalidated param then interpolates into the config service URL as
`/api/v1/chains/` — the chain *collection* endpoint. That returns 200 with a
page payload, `ChainSchema.parse` rejects it, and `ZodErrorFilter` maps the
domain-level ZodError to 502. The upstream transaction service is never
called; the response is also cached under the key `_chain`, so every later
request fails the same way until the TTL expires.

This accounted for 100% of the 502s on
`GET /v1/chains/:chainId/messages/:messageHash` — 4.5% of that route's
traffic over 30 days, and 99.3% of its 5xx.

Validate the route params per non-negotiable #1, so an empty chainId is a
422 rather than a 5xx, and guard `ConfigApi.getChain` so no caller can
address the collection endpoint with an empty id.

* refactor(messages): use ChainIdSchema and cover every route

Review follow-ups:

- Pipe chainId through ChainIdSchema rather than bare NumericStringSchema.
  api-dtos-and-validation.md marks the bare form as pre-ChainIdSchema drift
  and "not precedent to extend".
- Extend the empty-chainId case to all four routes on the controller, not
  only GET by hash. POST bodies come from the existing builders so chainId
  is the failing pipe rather than the body schema.
- Trim the getChain comment and assert HttpStatus.NOT_FOUND in the spec.

* docs(messages): declare the 422 the new param pipes can produce

Piping chainId and messageHash makes 422 a reachable outcome, but the
Swagger decorators declared only 2xx/404/400. Add
@ApiUnprocessableEntityResponse to all four routes on the controller —
each naming its own validated params — per the Swagger-completeness rule
in api-dtos-and-validation.md.

* refactor: group swagger decorators and drop duplicate empty-chainId test

Co-Authored-By: Claude Fable 5.1... (continued)

4201 of 4939 branches covered (85.06%)

Branch coverage included in aggregate %.

10659 of 11723 relevant lines covered (90.92%)

498.08 hits per line