fix(combos): PUT /api/combos/{id} rejects empty / no-op bodies with 400

[KooshaPari]

fix(combos): PUT /api/combos/{id} rejects empty / no-op bodies with 400

Closes #4898.

Summary

PUT /api/combos/{id} with an empty body {} (or { name: undefined } etc.) was a no-op that:

• Still triggered the cloud-sync path (syncToCloudIfEnabled()) — wasted bandwidth on a low-bandwidth link.
• Returned 200 with the unchanged combo — making "stuck toggle" bugs invisible: the dashboard thinks it succeeded, the user sees a button that "doesn't work", no console signal.

The new check fires after the JSON parse but before any side effect: if the body has zero updatable fields, return 400 with the standardized envelope.

Diff

src/app/api/combos/[id]/route.ts:101-122 — added 22 lines:

// Reject empty / no-op updates early. Saves a round-trip to the cloud-sync
// path and surfaces "stuck toggle" bugs to the client.
const updatableKeys = Object.keys(rawBody ?? {}).filter(
  (k) => k !== "id" && rawBody?.[k] !== undefined
);
if (updatableKeys.length === 0) {
  return NextResponse.json(
    {
      error: {
        message: "Invalid request",
        details: [
          {
            field: "body",
            message: "At least one updatable field is required",
          },
        ],
      },
    },
    { status: 400 }
  );
}

Test coverage

Three new tests in tests/unit/combo-routes-composite-tiers.test.ts:

Test	Asserts
PUT /api/combos rejects an empty body {} with 400	400 with the exact standardized envelope
PUT /api/combos rejects a body of only undefined fields with 400	{ name: undefined, isActive: undefined } → 400 with the same message
PUT /api/combos still accepts a single-field update (regression guard)	{ isActive: false } → 200; the handleToggleCombo flow stays unbroken

11/11 pass (8 prior + 3 new)

Pre-commit hooks pass: prettier, eslint, docs-sync (i18n + openapi), t11:any-budget, tracked-artifacts.

Why this is worth landing

1. Wasted cloud-sync round-trip. A user on a low-bandwidth link saw every misfire sync to the cloud.
2. Discoverability. A PUT /api/combos/{id} {} was a silent no-op. Users with a stale UI (the kind that triggers the prior 400-on-toggle bug from Bug: PUT /api/combos/{id} returns 400 on first GUI edit for any combo created in v3.8.31 or earlier (superRefine gate rejects pre-3.8.33 fallbackCompressionMode="lite" configs) #4773) had no signal to look at the console.
3. Tiny diff. 22 lines added to the route, 49 lines of tests. Single-purpose.
4. Plays nicely with [QoL] /dashboard/combos: handleToggleCombo silent failures (no toast, no error indication) #4893. The handleToggleCombo QoL fix surfaces the new 400 message in a toast: "At least one updatable field is required" is now user-visible instead of silent.

Risk

• None for the existing happy path — all 8 prior tests still pass.
• One regression guard test added for the legitimate { isActive: false } flow.

Related

• [QoL] PUT /api/combos/{id} accepts an empty body ({isActive: false}) — should reject with 400 #4898 — the issue this closes
• [QoL] /dashboard/combos: handleToggleCombo silent failures (no toast, no error indication) #4893 — companion QoL fix that makes this 400 user-visible in the dashboard toast
• PR fix(combos): skip composite-tiers validation on non-graph PUT updates #4880 — prior 400-on-toggle fix
• PR fix(combos): auto-promote zeroLatencyOptimizationsEnabled so legacy configs (pre-3.8.33 fallbackCompressionMode="lite") round-trip on the first GUI edit #4774 — established the 400 envelope shape this PR reuses

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[KooshaPari]

Closing — verified upstream v3.8.36 (commit 8080800, 16 commits past c522454) already ships the equivalent fix. Every file in this PR exists in upstream with the same purpose. No second implementation needed.

Tracking continues on the 2 unique-value PRs (#4777 refactor with 12 new files, #4778 standalone constant extraction).