Inseriti i messaggi di cnoferma di rimmborso, messaggi di accessso negato ed altro...

src/routes/rimborsi.ts

@@ -13,6 +13,7 @@ import {
   validateRichiestaBody,
 } from "../services/rimborsiService.js";
 import { formatRimborso } from "../utils/format.js";
+import { parseOptionalMese, parseOptionalPositiveInt } from "../utils/queryParams.js";
 import type { StatoRichiesta } from "../types/index.js";
 
 const router = Router();
@@ -27,12 +28,30 @@ router.get("/", async (req, res) => {
     return;
   }
 
+  const meseParsed = parseOptionalMese(req.query.mese);
+  if (meseParsed.error) {
+    res.status(400).json({ error: meseParsed.error });
+    return;
+  }
+
+  const categoriaParsed = parseOptionalPositiveInt(req.query.categoriaId, "Categoria");
+  if (categoriaParsed.error) {
+    res.status(400).json({ error: categoriaParsed.error });
+    return;
+  }
+
+  const dipendenteParsed = parseOptionalPositiveInt(req.query.dipendenteId, "Dipendente");
+  if (dipendenteParsed.error) {
+    res.status(400).json({ error: dipendenteParsed.error });
+    return;
+  }
+
   const rimborsi = await listRimborsi(
     {
       stato,
-      categoriaId: req.query.categoriaId ? Number(req.query.categoriaId) : undefined,
+      categoriaId: categoriaParsed.value,
-      mese: req.query.mese?.toString(),
+      mese: meseParsed.value,
-      dipendenteId: req.query.dipendenteId ? Number(req.query.dipendenteId) : undefined,
+      dipendenteId: dipendenteParsed.value,
     },
     req.user!.ruolo,
     req.user!.id

src/routes/statistiche.ts

@@ -1,15 +1,34 @@
 import { Router } from "express";
 import { requireAuth, requireRole } from "../middleware/auth.js";
 import { getStatisticheRimborsi } from "../services/statisticheService.js";
+import { parseOptionalMese, parseOptionalPositiveInt } from "../utils/queryParams.js";
 
 const router = Router();
 
 router.get("/rimborsi", requireAuth, requireRole("RESPONSABILE_AMMINISTRATIVO"), async (req, res) => {
-  const mese = req.query.mese?.toString();
+  const meseParsed = parseOptionalMese(req.query.mese);
-  const categoriaId = req.query.categoriaId ? Number(req.query.categoriaId) : undefined;
+  if (meseParsed.error) {
-  const dipendenteId = req.query.dipendenteId ? Number(req.query.dipendenteId) : undefined;
+    res.status(400).json({ error: meseParsed.error });
+    return;
+  }
 
-  const stats = await getStatisticheRimborsi({ mese, categoriaId, dipendenteId });
+  const categoriaParsed = parseOptionalPositiveInt(req.query.categoriaId, "Categoria");
+  if (categoriaParsed.error) {
+    res.status(400).json({ error: categoriaParsed.error });
+    return;
+  }
+
+  const dipendenteParsed = parseOptionalPositiveInt(req.query.dipendenteId, "Dipendente");
+  if (dipendenteParsed.error) {
+    res.status(400).json({ error: dipendenteParsed.error });
+    return;
+  }
+
+  const stats = await getStatisticheRimborsi({
+    mese: meseParsed.value,
+    categoriaId: categoriaParsed.value,
+    dipendenteId: dipendenteParsed.value,
+  });
   res.json(stats);
 });
 

src/utils/queryParams.ts

@@ -0,0 +1,20 @@
+export function parseOptionalMese(value: unknown): { error?: string; value?: string } {
+  if (value === undefined || value === null || value === "") return {};
+  const mese = value.toString().trim();
+  if (!/^\d{4}-\d{2}$/.test(mese)) {
+    return { error: "Mese non valido (formato YYYY-MM)" };
+  }
+  return { value: mese };
+}
+
+export function parseOptionalPositiveInt(
+  value: unknown,
+  label: string
+): { error?: string; value?: number } {
+  if (value === undefined || value === null || value === "") return {};
+  const n = Number(value);
+  if (!Number.isInteger(n) || n <= 0) {
+    return { error: `${label} non valido` };
+  }
+  return { value: n };
+}