From 5053130e351f691b7aef5410805e8e881e0ac237 Mon Sep 17 00:00:00 2001
From: Zack Pollard <zackpollard@ymail.com>
Date: Wed, 26 Feb 2025 14:35:51 +0000
Subject: [PATCH] fix: sync set ack validation (#16320)

---
 server/src/services/sync.service.ts | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/server/src/services/sync.service.ts b/server/src/services/sync.service.ts
index b94e8cfcbf..98e4d5fb09 100644
--- a/server/src/services/sync.service.ts
+++ b/server/src/services/sync.service.ts
@@ -1,4 +1,4 @@
-import { ForbiddenException, Injectable } from '@nestjs/common';
+import { BadRequestException, ForbiddenException, Injectable } from '@nestjs/common';
 import { Insertable } from 'kysely';
 import { DateTime } from 'luxon';
 import { Writable } from 'node:stream';
@@ -43,8 +43,6 @@ export class SyncService extends BaseService {
   }
 
   async setAcks(auth: AuthDto, dto: SyncAckSetDto) {
-    // TODO ack validation
-
     const sessionId = auth.session?.id;
     if (!sessionId) {
       return throwSessionRequired();
@@ -53,6 +51,10 @@ export class SyncService extends BaseService {
     const checkpoints: Insertable<SessionSyncCheckpoints>[] = [];
     for (const ack of dto.acks) {
       const { type } = fromAck(ack);
+      // TODO proper ack validation via class validator
+      if (!Object.values(SyncEntityType).includes(type)) {
+        throw new BadRequestException(`Invalid ack type: ${type}`);
+      }
       checkpoints.push({ sessionId, type, ack });
     }