Validate referral invite email types

[absalonCRC]

Summary

• fixes bug: referral invite API crashes on non-string email entries #141
• rejects non-string entries in the referral invite emails array with a 400 response
• prevents malformed invite payloads from reaching throttling, duplicate lookup, insert, or email-send work
• adds regression coverage for mixed string/non-string invite arrays

Why

The endpoint already checks that emails is an array, but then calls trim().toLowerCase() on every entry. A malformed client payload with a non-string entry could throw and return a generic 500 instead of a validation error.

Validation

• pnpm test:run src/app/api/referrals/route.test.ts
• pnpm exec eslint src/app/api/referrals/route.ts src/app/api/referrals/route.test.ts
• pnpm type-check
• git diff --check

Payment for the active uGig affiliate testing bounty can go to SOL: 27sdMYXofqoM9qR13bZhccRNYeEgYn5EoHXTSJn4QWKP.

Payment fallback: PayPal cultofrozen@gmail.com

[greptile-apps]

Greptile Summary

This PR closes a gap in the POST /api/referrals input validation: the endpoint already verified that emails is a non-empty array, but any non-string entry would reach trim().toLowerCase() and throw an unhandled 500. A single Array.every type-guard is inserted ahead of the throttle/DB path to return a clean 400 instead.

• Adds emails.every(e => typeof e === \"string\") between the empty-array check and the 20-item limit check, so the new guard fires before any service-client or DB calls.
• Adds a Vitest regression test that sends [\"friend@test.com\", 42] and asserts a 400 response with the expected error message and confirms createServiceClient was never invoked.

Confidence Score: 5/5

Safe to merge — the change is a narrow, well-placed input guard with a matching regression test and no modifications to existing logic.

The new type guard is inserted at exactly the right point in the validation chain, before any service client or database work begins. All non-string JSON types (numbers, booleans, null, objects) are correctly rejected by the typeof === string check. The regression test verifies the 400 path end-to-end and confirms no downstream side effects fire.

No files require special attention.

Important Files Changed

Filename	Overview
src/app/api/referrals/route.ts	Adds a pre-flight type guard for the emails array before any downstream work (throttle checks, DB inserts, email sends); correctly placed and covers all non-string JSON types including null, booleans, and objects.
src/app/api/referrals/route.test.ts	Adds a regression test for mixed string/non-string arrays; verifies the 400 status, error message, and that createServiceClient is never reached — adequately covering the new guard.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[POST /api/referrals] --> B{Auth valid?}
    B -- No --> C[401 Unauthorized]
    B -- Yes --> D{emails is non-empty array?}
    D -- No --> E[400 Please provide an array]
    D -- Yes --> F{All entries are strings?}
    F -- No --> G[400 All invite emails must be strings]
    F -- Yes --> H{emails.length > 20?}
    H -- Yes --> I[400 Maximum 20 invites]
    H -- No --> J[Throttle check: hourly/daily limits]
    J --> K[Deduplicate against existing invites]
    K --> L[Validate email format with regex]
    L --> M[Insert referral rows to DB]
    M --> N[Send invite emails]
    N --> O[200 Response]

Loading

_{Reviews (1): Last reviewed commit: "Validate referral invite email types" | Re-trigger Greptile}