fix(api): reject empty results arrays in /api/runs

app/api/runs/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { db, checkIngestToken } from "@/lib/supabase";
+import { validateIngestPayload } from "@/lib/validate-ingest";
 import type { IngestPayload } from "@/lib/types";
 
 export const runtime = "nodejs";
@@ -23,7 +24,7 @@ export async function GET() {
           output: "string (optional)",
           expected: "string (optional)",
         },
-      ],
+      ], // required; must contain at least one result
     },
     returns: { ok: true, runId: "uuid", regressed: 0, flagged: 0, shouldFail: false },
   });
@@ -45,11 +46,9 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: "invalid json" }, { status: 400 });
   }
 
-  if (!body.suite || !body.label || !Array.isArray(body.results)) {
-    return NextResponse.json(
-      { error: "suite, label and results[] are required" },
-      { status: 400 },
-    );
+  const validation = validateIngestPayload(body);
+  if (!validation.ok) {
+    return NextResponse.json({ error: validation.error }, { status: 400 });
   }
 
   const supabase = db();

lib/validate-ingest.test.ts

@@ -0,0 +1,40 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { validateIngestPayload } from "./validate-ingest.ts";
+
+test("rejects an empty results array", () => {
+  const result = validateIngestPayload({
+    suite: "smoke",
+    label: "run",
+    results: [],
+  });
+
+  assert.equal(result.ok, false);
+  assert.equal(
+    (result as { ok: false; error: string }).error,
+    "results[] must contain at least one result",
+  );
+});
+
+test("rejects missing results array", () => {
+  const result = validateIngestPayload({
+    suite: "smoke",
+    label: "run",
+  });
+
+  assert.equal(result.ok, false);
+  assert.equal(
+    (result as { ok: false; error: string }).error,
+    "results[] is required",
+  );
+});
+
+test("accepts a non-empty results array", () => {
+  const result = validateIngestPayload({
+    suite: "smoke",
+    label: "run",
+    results: [{ caseName: "case-1", passed: true }],
+  });
+
+  assert.equal(result.ok, true);
+});

lib/validate-ingest.ts

@@ -0,0 +1,33 @@
+export type ValidateIngestResult =
+  | { ok: true }
+  | { ok: false; error: string };
+
+export function validateIngestPayload(body: unknown): ValidateIngestResult {
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return { ok: false, error: "invalid body" };
+  }
+
+  const b = body as {
+    suite?: unknown;
+    label?: unknown;
+    results?: unknown;
+  };
+
+  if (typeof b.suite !== "string" || b.suite === "") {
+    return { ok: false, error: "suite is required" };
+  }
+
+  if (typeof b.label !== "string" || b.label === "") {
+    return { ok: false, error: "label is required" };
+  }
+
+  if (!Array.isArray(b.results)) {
+    return { ok: false, error: "results[] is required" };
+  }
+
+  if (b.results.length === 0) {
+    return { ok: false, error: "results[] must contain at least one result" };
+  }
+
+  return { ok: true };
+}

package.json

@@ -8,6 +8,7 @@
     "build": "next build",
     "start": "next start",
     "lint": "next lint",
+    "test": "node --test --no-warnings lib/validate-ingest.test.ts",
     "cf:build": "NODE_OPTIONS=--no-deprecation opennextjs-cloudflare build",
     "cf:preview": "NODE_OPTIONS=--no-deprecation opennextjs-cloudflare build && NODE_OPTIONS=--no-deprecation opennextjs-cloudflare preview",
     "deploy": "NODE_OPTIONS=--no-deprecation opennextjs-cloudflare build && NODE_OPTIONS=--no-deprecation opennextjs-cloudflare deploy"

tsconfig.json

@@ -36,6 +36,7 @@
     ".next/dev/types/**/*.ts"
   ],
   "exclude": [
-    "node_modules"
+    "node_modules",
+    "**/*.test.ts"
   ]
 }