fix(server): validate permission and question ids (#26456)

2026-05-09 00:20:28 -04:00
parent 3570a7d5e4
commit 5f12ad1828
3 changed files with 32 additions and 3 deletions
@@ -6,7 +6,7 @@ import { Newtype } from "@/util/schema"

 export class QuestionID extends Newtype<QuestionID>()(
  "QuestionID",
-  Schema.String.annotate({ [ZodOverride]: Identifier.schema("question") }),
+  Schema.String.check(Schema.isStartsWith("que")).annotate({ [ZodOverride]: Identifier.schema("question") }),
 ) {
  static ascending(id?: string): QuestionID {
    return this.make(Identifier.ascending("question", id))