fix: validate swipe restaurant ids against room candidates

2026-03-03 12:06:03 +08:00
parent f3d8a58603
commit 8b4ab415fd
3 changed files with 24 additions and 2 deletions
@@ -23,8 +23,10 @@ export const POST = apiHandler(async (req, { params }) => {
    }

    const restaurantIndex = data.restaurants.findIndex((r) => r.id === rid);
+    if (restaurantIndex < 0) {
+      throw new ApiError("restaurantId 不存在于该房间候选列表", 400);
+    }
    const alreadySwiped =
-      restaurantIndex >= 0 &&
      restaurantIndex < (data.swipeCounts[userId] ?? 0);

    if (alreadySwiped) return data;