Skip to content

fix(api): clamp days query param in hourly contributions route#2235

Open
Honey-pg wants to merge 4 commits into
Priyanshu-byte-coder:mainfrom
Honey-pg:fix/hourly-contributions-days-validation
Open

fix(api): clamp days query param in hourly contributions route#2235
Honey-pg wants to merge 4 commits into
Priyanshu-byte-coder:mainfrom
Honey-pg:fix/hourly-contributions-days-validation

Conversation

@Honey-pg

@Honey-pg Honey-pg commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

Summary

Parse days as an integer and clamp to 1..365 in GET /api/metrics/contributions/hourly, matching other metrics routes and preventing malformed input (negatives, fractions, Infinity, huge values) from producing invalid date windows or 502 errors.


#Closed #2193

Type of Change

  • Bug fix
  • New feature
  • Documentation update
  • Refactor / code cleanup

Changes Made

  • Replaced Number() parsing with parseInt + default/clamp logic in src/app/api/metrics/contributions/hourly/route.ts
  • Added test/contributions-hourly.test.ts covering negative, fractional, zero, unbounded, and missing days inputs

How to Test

  1. Run npm run type-check
  2. Run npx vitest run test/contributions-hourly.test.ts
  3. Optionally hit the route with malformed query params and confirm 200 responses with clamped days:
    • ?days=-30days: 1
    • ?days=Infinitydays: 30
    • ?days=999999days: 365
    • no param → days: 30

Checklist

  • Linked issue in summary
  • npm run lint passes locally
  • No TypeScript errors (npm run type-check)
  • Self-reviewed the diff
  • Added/updated tests if applicable

Additional Notes

Aligns with the existing validation pattern in contributions/route.ts, repos/route.ts, and productive-hours/route.ts. Hourly contributions keeps its default of 30 days when the param is missing or invalid.

Parse days as integer and clamp to 1..365, matching other metrics routes and preventing malformed input from causing 502 errors.
@vercel

vercel Bot commented Jun 9, 2026

Copy link
Copy Markdown

@Honey-pg is attempting to deploy a commit to the PRIYANSHU DOSHI's projects Team on Vercel.

A member of the Team first needs to authorize it.

@github-actions github-actions Bot added gssoc26 GSSoC 2026 contribution type:bug GSSoC type bonus: bug fix type:testing GSSoC type bonus: tests (+10 pts) labels Jun 9, 2026
@github-actions

github-actions Bot commented Jun 9, 2026

Copy link
Copy Markdown

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

  • level:beginner — 20 pts
  • level:intermediate — 35 pts
  • level:advanced — 55 pts
  • level:critical — 80 pts

Quality (optional):

  • quality:clean — ×1.2 multiplier
  • quality:exceptional — ×1.5 multiplier

Validation (required to score):

  • gssoc:approved — counts for points
  • gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

Honey-pg and others added 3 commits June 9, 2026 11:26
Replace page.evaluate fetch on about:blank with Playwright request + session cookie so relative API URLs resolve. Assert authenticated access returns JSON instead of requiring GitHub 200 with mock token.
The Playwright api.spec.ts fix belongs on security/x-dns-prefetch-control-on, not this branch.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gssoc26 GSSoC 2026 contribution type:bug GSSoC type bonus: bug fix type:testing GSSoC type bonus: tests (+10 pts)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Hourly contributions API accepts invalid day ranges

1 participant