[codex] Validate zap leaderboard filters

[rissrice2105-agent]

Fixes #379.

Summary:

• reject unsupported period values on /api/leaderboard/zaps before querying Supabase
• reject unsupported sort values instead of silently falling back to received zaps
• add regression coverage for both invalid query parameters and confirm the DB mock is not called

Validation:

• vitest run src/app/api/leaderboard/zaps/route.test.ts
• tsc --noEmit

[greptile-apps]

Greptile Summary

This PR adds input validation to GET /api/leaderboard/zaps, returning HTTP 400 with a descriptive error message when an unsupported period or sort value is supplied, before any Supabase query is made. Two regression tests confirm the 400 responses and verify the database mock is never touched on invalid input.

• Route validation (route.ts): Two allowlist checks inserted after parameter parsing and before createServiceClient(); defaults ("all" / "received") are still applied for missing params, so existing callers are unaffected.
• Tests (route.test.ts): Each new test skips mockLeaderboardQuery() intentionally since the early return means no DB setup is needed; expect(mockFrom).not.toHaveBeenCalled() correctly guards against accidental DB access.

Confidence Score: 5/5

This PR is safe to merge; the added validation is a strict subset of the existing accepted values and the early returns do not alter any happy-path logic.

Both changed files are narrow and self-contained. The allowlists in route.ts match the values documented in the JSDoc comment and used in the route's own conditional branches, so there is no risk of rejecting previously valid inputs. The tests cover the two new code paths, confirm no DB calls leak through, and are correctly isolated by vi.clearAllMocks() in beforeEach.

No files require special attention.

Important Files Changed

Filename	Overview
src/app/api/leaderboard/zaps/route.ts	Adds early-exit validation for period and sort query parameters, returning HTTP 400 before touching Supabase; logic is correct and consistent with the existing allowed-value sets.
src/app/api/leaderboard/zaps/route.test.ts	Adds two regression tests that verify 400 responses and confirm mockFrom is never invoked when validation fails; test isolation via beforeEach + vi.clearAllMocks() is correct.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[GET /api/leaderboard/zaps] --> B[Parse period, sort, limit]
    B --> C{period valid?\nall / month / week}
    C -- No --> D[400 Invalid period]
    C -- Yes --> E{sort valid?\nreceived / sent}
    E -- No --> F[400 Invalid sort]
    E -- Yes --> G[createServiceClient]
    G --> H[Query zaps table\nwith date filter]
    H --> I{DB error?}
    I -- Yes --> J[500 error]
    I -- No --> K[Aggregate by user]
    K --> L[Sort + slice top N]
    L --> M{Any results?}
    M -- No --> N[200 empty leaderboard]
    M -- Yes --> O[Fetch profiles]
    O --> P[200 leaderboard response]

Loading

_{Reviews (1): Last reviewed commit: "Validate zap leaderboard filters" | Re-trigger Greptile}