1.7 KiB
Notes — auditor2 HIGH fix (VK participant records)
Base: 17faecd962c2cf40e0a3f6ec4434811cfffdd312. No commit created; HEAD remains the base SHA.
Implementation validates VK response object/count/items before pagination accepts a page. Likes must be profile objects with positive safe-integer IDs and valid optional profile field types; duplicate likes IDs across pages fail. Comment authors must be safe integers and nonzero. Negative safe integers are explicitly treated as community authors and excluded; malformed/zero authors fail. Optional comment profiles, when provided, must be an array of valid positive-ID profiles with no duplicate IDs. All validation failures throw VkIncompleteDataError before the provider returns to the import route.
The route regression table covers 25 malformed response variants (likes and comments, including missing/null items/arrays/counts, invalid IDs, duplicate likes/profile IDs, and invalid profile properties). Every case asserts HTTP VK_INCOMPLETE_DATA and that the previously stored participant list remains byte-for-byte equal at the repository result layer. A separate case confirms an otherwise valid negative community author remains intentionally excluded.
Verification run:
USE_VK_MOCK=true npx vitest run tests/vk-r3-safety.test.ts— exit 0, 1 file / 13 tests passed; the route table exercises 25 response cases.npx tsc --noEmit— exit 0.git diff --check -- src/providers/vk/vk-provider.ts tests/vk-r3-safety.test.ts— exit 0.
No npm ci, prisma generation, full test, lint or build was run for this narrow follow-up. Those gates need to be repeated by the coordinator after the complete shared patch is stable.