fix(backend): validate guildId snowflake on all 18 music routes

[LucasSantana-Dev]

What

Closes #1200 — extends the snowflake-validation pattern from #1158/#1172 to the music surface, the last unguarded :guildId route family.

Changes

• validateParams(guildIdParam) inserted after requireAuth, before handler logic (the ordering point from fix(backend): enforce discord snowflake validation on all guild routes #1172) on every music route: autoplayRoutes (2), stateRoutes (2, including the SSE stream), playbackRoutes (9), queueRoutes (5) = 18 routes (the issue title says 14; its own enumeration lists 18 — all covered).
• snowflakeValidation.test.ts gains a parametrized Music Routes block: strict toBe(400) on malformed guildId + a valid-id non-400 pass per route. The SSE stream route is rejection-only (a valid SSE request never terminates under supertest).
• Autoplay integration fixture guild-123 → valid snowflake — the old fixture was itself malformed and is now (correctly) rejected by the guard.

Verification

• Backend: 989/989 (35 new tests), lint clean, type:check green across workspaces (pre-commit)
• Handler-level validation tests (genres array shape/limit) still hit the handler's own checks with the valid fixture — no behavior change for well-formed requests

---

Summary by cubic

Validate :guildId as a snowflake on all 18 music routes, applied right after auth to block bad IDs before handler logic; also deduplicates playback route registrations. Completes #1200 and aligns with the pattern from #1158/#1172.

• Bug Fixes

  • Added validateParams(guildIdParam) to every music route in autoplayRoutes, stateRoutes (incl. SSE), playbackRoutes, and queueRoutes (18 total), placed after requireAuth.
  • Expanded snowflakeValidation.test.ts with a parameterized Music Routes suite: invalid IDs return 400; valid IDs do not; SSE stream covered for rejection only.
  • Updated autoplay integration fixtures to a valid snowflake ID; no change for well-formed requests.

• Refactors

  • Collapsed identical no-body playback routes (pause, resume, skip, stop, shuffle) into a single registration loop; behavior and paths unchanged.

^{Written for commit 4d6b622. Summary will update on new commits.}

Summary by CodeRabbit

• Bug Fixes

  • Added guild ID validation across all music API endpoints to prevent invalid requests.
  • Improved genre data normalization for consistency in autoplay settings.

• Tests

  • Added comprehensive test suite verifying parameter validation for music endpoints.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
lucky	Ready	Preview, Comment	Jun 10, 2026 2:48am

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds snowflake-format guildId validation to 14 music API endpoints across 4 route files via validateParams(guildIdParam) middleware. It refactors autoplay genres normalization logic and updates tests to verify validation works correctly.

Changes

Music Route guildId Validation

Layer / File(s)	Summary
Autoplay routes with genres refactoring packages/backend/src/routes/music/autoplayRoutes.ts, packages/backend/tests/integration/routes/autoplay.test.ts	Imports validateParams and guildIdParam, applies validation middleware to GET and PUT autoplay genres endpoints. Refactors genres normalization in PUT handler to use a dedicated normalized array with lowercase/trim and Set-based deduplication. Integration tests updated to numeric guild ID and verify updateGuildSettings receives correct ID and normalized genres.
Playback routes validation packages/backend/src/routes/music/playbackRoutes.ts	Imports and wires validateParams(guildIdParam) into 9 playback endpoints (play, pause, resume, skip, stop, volume, shuffle, repeat, seek) after requireAuth middleware.
Queue routes validation packages/backend/src/routes/music/queueRoutes.ts	Imports and applies validateParams(guildIdParam) to 5 queue endpoints (get queue, move, remove, clear, import) in the middleware chain.
State routes validation and formatting packages/backend/src/routes/music/stateRoutes.ts	Imports and adds validateParams(guildIdParam) to music stream (SSE) and state (JSON) endpoints. Reformats heartbeat disconnection guard if condition into multi-line boolean expression.
Comprehensive music route validation test suite packages/backend/tests/unit/routes/snowflakeValidation.test.ts	Adds musicControlService mock and extends guildSettingsService.updateGuildSettings mock. Imports music route setup functions and introduces parameterized test suite that verifies all 14 music routes reject non-snowflake guildId with HTTP 400 and error field, and accept valid guildId.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• LucasSantana-Dev/Lucky#570: Adds bot /autoplay genre commands that manage autoplayGenres settings via guildSettingsService.updateGuildSettings, which this PR now validates and normalizes in the autoplay API.

Suggested labels

backend, size/m

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: adding guildId snowflake validation to 18 music routes in the backend.
Linked Issues check	✅ Passed	The PR successfully addresses issue #1200 by adding validateParams(guildIdParam) middleware to all targeted music routes across four files (autoplay, state, playback, queue) with proper ordering after requireAuth.
Out of Scope Changes check	✅ Passed	All changes are scoped to adding guildId validation to music routes and updating corresponding tests; no unrelated modifications are present.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1200-music-guildid-validation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Failed to generate code suggestions for PR

[coderabbitai]

🧹 Nitpick comments (1)

packages/backend/tests/unit/routes/snowflakeValidation.test.ts (1)

360-522: ⚡ Quick win

Consider testing additional invalid guildId edge cases for music routes.

The existing Starboard and Levels test suites (Lines 100-107, 193-200) validate six different invalid patterns: too-short IDs, too-long IDs, mixed alphanumeric strings, etc. The Music Routes suite uses a single invalid value 'not-a-snowflake', which verifies the middleware is wired but doesn't exercise boundary conditions like 16-digit (too short) or 21-digit (too long) snowflakes.

While all music routes share the same validateParams(guildIdParam) middleware and should behave identically, testing a few additional edge cases would strengthen confidence that the regex pattern /^\d{17,20}$/ correctly rejects boundary violations.

🧪 Suggested edge cases to add

     describe('Music Routes (`#1200`)', () => {
         const validGuildId = '123456789012345678'
-        const invalidGuildId = 'not-a-snowflake'
+        const invalidGuildIds = [
+            'not-a-snowflake',
+            '123',                      // too short
+            '123456789012345678901',   // 21 digits (too long)
+        ]

Then update the rejection test to iterate over invalidGuildIds:

-        test.each(routes)(
-            '$name rejects invalid guildId with 400',
-            async ({ setup, method, path, body }) => {
+        test.each(routes.flatMap(route => 
+            invalidGuildIds.map(id => ({ ...route, invalidGuildId: id }))
+        ))(
+            '$name rejects invalid guildId "$invalidGuildId" with 400',
+            async ({ setup, method, path, body, invalidGuildId }) => {
                 const app = createApp(setup)
                 let req = request(app)[method](path(invalidGuildId))

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/backend/tests/unit/routes/snowflakeValidation.test.ts` around lines
360 - 522, Add extra invalid guildId edge cases to the Music Routes tests by
replacing the single invalidGuildId string with an array (e.g., invalidGuildIds
= ['not-a-snowflake', '1234567890123456' /*16-digit too short*/,
'123456789012345678901' /*21-digit too long*/, 'abc123456789012345', ''] ) and
update both rejection tests (the test.each over routes named '$name rejects
invalid guildId with 400' and the standalone 'GET music/stream rejects invalid
guildId with 400') to iterate over invalidGuildIds, calling each route path with
every invalid id; ensure you still use the same middleware
validateParams(guildIdParam) by keeping setup functions (setupAutoplayRoutes,
setupStateRoutes, setupPlaybackRoutes, setupQueueRoutes) and maintain assertions
expect(res.status).toBe(400) and expect(res.body).toHaveProperty('error').

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@packages/backend/tests/unit/routes/snowflakeValidation.test.ts`:
- Around line 360-522: Add extra invalid guildId edge cases to the Music Routes
tests by replacing the single invalidGuildId string with an array (e.g.,
invalidGuildIds = ['not-a-snowflake', '1234567890123456' /*16-digit too short*/,
'123456789012345678901' /*21-digit too long*/, 'abc123456789012345', ''] ) and
update both rejection tests (the test.each over routes named '$name rejects
invalid guildId with 400' and the standalone 'GET music/stream rejects invalid
guildId with 400') to iterate over invalidGuildIds, calling each route path with
every invalid id; ensure you still use the same middleware
validateParams(guildIdParam) by keeping setup functions (setupAutoplayRoutes,
setupStateRoutes, setupPlaybackRoutes, setupQueueRoutes) and maintain assertions
expect(res.status).toBe(400) and expect(res.body).toHaveProperty('error').

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ebc22d84-3aae-4639-aa93-5aa3563eada1

📥 Commits

Reviewing files that changed from the base of the PR and between a34e777 and 96818b2.

📒 Files selected for processing (6)

• packages/backend/src/routes/music/autoplayRoutes.ts
• packages/backend/src/routes/music/playbackRoutes.ts
• packages/backend/src/routes/music/queueRoutes.ts
• packages/backend/src/routes/music/stateRoutes.ts
• packages/backend/tests/integration/routes/autoplay.test.ts
• packages/backend/tests/unit/routes/snowflakeValidation.test.ts

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (12)

• GitHub Check: Test — shared
• GitHub Check: Checks
• GitHub Check: Test — backend
• GitHub Check: Test — frontend
• GitHub Check: Test — bot
• GitHub Check: quality / Lint (lint)
• GitHub Check: quality / Dead code (knip)
• GitHub Check: quality / SAST (CodeQL) (javascript-typescript)
• GitHub Check: Build — frontend
• GitHub Check: Build — backend
• GitHub Check: Security
• GitHub Check: Build — bot

🔇 Additional comments (19)

packages/backend/src/routes/music/autoplayRoutes.ts (6)

4-5: LGTM!

---

14-14: LGTM!

---

17-18: LGTM!

---

28-28: LGTM!

---

51-53: LGTM!

---

55-60: LGTM!

packages/backend/src/routes/music/playbackRoutes.ts (4)

5-6: LGTM!

---

40-40: LGTM!

Also applies to: 62-62, 77-77

---

92-92: LGTM!

Also applies to: 107-107, 122-122

---

145-145: LGTM!

Also applies to: 160-160, 185-185

packages/backend/src/routes/music/queueRoutes.ts (3)

5-6: LGTM!

---

37-37: LGTM!

Also applies to: 52-52

---

73-73: LGTM!

Also applies to: 93-93, 108-108

packages/backend/src/routes/music/stateRoutes.ts (4)

4-5: LGTM!

---

13-13: LGTM!

---

46-50: LGTM!

---

79-79: LGTM!

packages/backend/tests/integration/routes/autoplay.test.ts (1)

22-35: LGTM!

Also applies to: 59-148

packages/backend/tests/unit/routes/snowflakeValidation.test.ts (1)

36-45: LGTM!

Also applies to: 82-85

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
94.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud