From ed70cd7f0f4ec84d8f0e9636aa96d8164a8e7077 Mon Sep 17 00:00:00 2001 From: jikrana Date: Tue, 14 Jul 2026 14:27:32 +0530 Subject: [PATCH] fix(analytics): validate range parameter and return 400 for unsupported values (Closes #858) --- backend/controllers/analyticsController.js | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/backend/controllers/analyticsController.js b/backend/controllers/analyticsController.js index beea0f2e..472c9059 100644 --- a/backend/controllers/analyticsController.js +++ b/backend/controllers/analyticsController.js @@ -98,9 +98,16 @@ const getSummary = async (req, res) => { // GET /analytics/trends?range=daily|weekly|monthly const getTrends = async (req, res) => { try { - const range = ANALYTICS_RANGES.includes(req.query.range) - ? req.query.range - : "daily"; + const { range } = req.query; + + if (range !== undefined && !ANALYTICS_RANGES.includes(range)) { + return res.status(400).json({ + error: `Invalid range value. Supported values are: ${ANALYTICS_RANGES.join(', ')}.` + }); + } + + // If range is not provided, default to 'daily' + const selectedRange = range || "daily"; const userId = getUserObjectId(req); const trends = await History.aggregate([ @@ -115,7 +122,7 @@ const getTrends = async (req, res) => { { $group: { _id: { - date: { $dateToString: { format: DATE_FORMATS[range], date: "$createdAt" } }, + date: { $dateToString: { format: DATE_FORMATS[selectedRange], date: "$createdAt" } }, label: "$prediction", }, count: { $sum: 1 },