test: drive the non-text message-part rejection 400 path (#63) #103

New Issue

Ghost · 2026-06-21T05:05:38+03:00

Ghost commented

2026-06-21 05:05:38 +03:00

PR #101 (commit 2b4ec0bf, closes #63) made the anonymous share-chat funnel reject any message containing a non-text part: apps/server/src/core/ai-chat/public-share-chat.controller.ts:295 throw new HttpException('Unsupported message content', 400) — a size-cap-bypass guard.

Gap: the 400 path is never driven. The string appears in no spec, though the funnel is already fully test-harnessed.

Needed: in the controller funnel spec, add a case with messages:[{ role:'user', parts:[{type:'tool-call'}] }] asserting status 400; plus a message mixing a text and a non-text part still 400s (rejected before the 413 size check).

Found in code review of PR #101.

PR #101 (commit 2b4ec0bf, closes #63) made the anonymous share-chat funnel reject any message containing a non-text part: apps/server/src/core/ai-chat/public-share-chat.controller.ts:295 `throw new HttpException('Unsupported message content', 400)` — a size-cap-bypass guard. **Gap:** the 400 path is never driven. The string appears in no spec, though the funnel is already fully test-harnessed. **Needed:** in the controller funnel spec, add a case with `messages:[{ role:'user', parts:[{type:'tool-call'}] }]` asserting status 400; plus a message mixing a text and a non-text part still 400s (rejected before the 413 size check). _Found in code review of PR #101._

Ghost added the test security labels 2026-06-21 05:05:38 +03:00

vvzvlad referenced this issue from a commit

2026-06-21 05:24:26 +03:00

fix(review): address PR #101 review findings (dead DI, docs)

Ghost referenced this issue from a commit

2026-06-21 05:49:35 +03:00

test(share-ai): drive the non-text message-part 400 path (#103)

Ghost referenced this issue

2026-06-21 05:51:20 +03:00

fix: review/red-team batch 2 — 30 issues (security, ws, page-templates, html-embed, mcp, tests, docs) #101

Ghost referenced this issue

2026-06-21 05:53:55 +03:00