From dc2eea7e15a1704a8d2288b8bc1b582e12f01850 Mon Sep 17 00:00:00 2001
From: AV77web <villari.andrea@libero.it>
Date: Tue, 9 Jun 2026 16:26:52 +0200
Subject: [PATCH] Inseriti i messaggi di cnoferma di rimmborso, messaggi di
 accessso negato ed altro...

---
 src/routes/rimborsi.ts    | 25 ++++++++++++++++++++++---
 src/routes/statistiche.ts | 27 +++++++++++++++++++++++----
 src/utils/queryParams.ts  | 20 ++++++++++++++++++++
 3 files changed, 65 insertions(+), 7 deletions(-)
 create mode 100644 src/utils/queryParams.ts

diff --git a/src/routes/rimborsi.ts b/src/routes/rimborsi.ts
index 16fda99..15902eb 100644
--- a/src/routes/rimborsi.ts
+++ b/src/routes/rimborsi.ts
@@ -13,6 +13,7 @@ import {
   validateRichiestaBody,
 } from "../services/rimborsiService.js";
 import { formatRimborso } from "../utils/format.js";
+import { parseOptionalMese, parseOptionalPositiveInt } from "../utils/queryParams.js";
 import type { StatoRichiesta } from "../types/index.js";
 
 const router = Router();
@@ -27,12 +28,30 @@ router.get("/", async (req, res) => {
     return;
   }
 
+  const meseParsed = parseOptionalMese(req.query.mese);
+  if (meseParsed.error) {
+    res.status(400).json({ error: meseParsed.error });
+    return;
+  }
+
+  const categoriaParsed = parseOptionalPositiveInt(req.query.categoriaId, "Categoria");
+  if (categoriaParsed.error) {
+    res.status(400).json({ error: categoriaParsed.error });
+    return;
+  }
+
+  const dipendenteParsed = parseOptionalPositiveInt(req.query.dipendenteId, "Dipendente");
+  if (dipendenteParsed.error) {
+    res.status(400).json({ error: dipendenteParsed.error });
+    return;
+  }
+
   const rimborsi = await listRimborsi(
     {
       stato,
-      categoriaId: req.query.categoriaId ? Number(req.query.categoriaId) : undefined,
-      mese: req.query.mese?.toString(),
-      dipendenteId: req.query.dipendenteId ? Number(req.query.dipendenteId) : undefined,
+      categoriaId: categoriaParsed.value,
+      mese: meseParsed.value,
+      dipendenteId: dipendenteParsed.value,
     },
     req.user!.ruolo,
     req.user!.id
diff --git a/src/routes/statistiche.ts b/src/routes/statistiche.ts
index 9208b26..f30a3ba 100644
--- a/src/routes/statistiche.ts
+++ b/src/routes/statistiche.ts
@@ -1,15 +1,34 @@
 import { Router } from "express";
 import { requireAuth, requireRole } from "../middleware/auth.js";
 import { getStatisticheRimborsi } from "../services/statisticheService.js";
+import { parseOptionalMese, parseOptionalPositiveInt } from "../utils/queryParams.js";
 
 const router = Router();
 
 router.get("/rimborsi", requireAuth, requireRole("RESPONSABILE_AMMINISTRATIVO"), async (req, res) => {
-  const mese = req.query.mese?.toString();
-  const categoriaId = req.query.categoriaId ? Number(req.query.categoriaId) : undefined;
-  const dipendenteId = req.query.dipendenteId ? Number(req.query.dipendenteId) : undefined;
+  const meseParsed = parseOptionalMese(req.query.mese);
+  if (meseParsed.error) {
+    res.status(400).json({ error: meseParsed.error });
+    return;
+  }
 
-  const stats = await getStatisticheRimborsi({ mese, categoriaId, dipendenteId });
+  const categoriaParsed = parseOptionalPositiveInt(req.query.categoriaId, "Categoria");
+  if (categoriaParsed.error) {
+    res.status(400).json({ error: categoriaParsed.error });
+    return;
+  }
+
+  const dipendenteParsed = parseOptionalPositiveInt(req.query.dipendenteId, "Dipendente");
+  if (dipendenteParsed.error) {
+    res.status(400).json({ error: dipendenteParsed.error });
+    return;
+  }
+
+  const stats = await getStatisticheRimborsi({
+    mese: meseParsed.value,
+    categoriaId: categoriaParsed.value,
+    dipendenteId: dipendenteParsed.value,
+  });
   res.json(stats);
 });
 
diff --git a/src/utils/queryParams.ts b/src/utils/queryParams.ts
new file mode 100644
index 0000000..0c32cba
--- /dev/null
+++ b/src/utils/queryParams.ts
@@ -0,0 +1,20 @@
+export function parseOptionalMese(value: unknown): { error?: string; value?: string } {
+  if (value === undefined || value === null || value === "") return {};
+  const mese = value.toString().trim();
+  if (!/^\d{4}-\d{2}$/.test(mese)) {
+    return { error: "Mese non valido (formato YYYY-MM)" };
+  }
+  return { value: mese };
+}
+
+export function parseOptionalPositiveInt(
+  value: unknown,
+  label: string
+): { error?: string; value?: number } {
+  if (value === undefined || value === null || value === "") return {};
+  const n = Number(value);
+  if (!Number.isInteger(n) || n <= 0) {
+    return { error: `${label} non valido` };
+  }
+  return { value: n };
+}