task f: validate media_id and sessionID in progress handler and service

3 files changed, 26 insertions, 1 deletions

diff --git a/internal/api/handlers_media.go b/internal/api/handlers_media.go
index c986eb3..c761bce 100644
--- a/internal/api/handlers_media.go
+++ b/internal/api/handlers_media.go
@@ -457,9 +457,14 @@ func (s *Server) handleProgress(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "media_id required"})
 		return
 	}
+	sessionID := sessionIDFromContext(r)
+	if sessionID == "" {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "session required"})
+		return
+	}
 	err := s.progressSvc.UpdateProgress(
 		r.Context(),
-		sessionIDFromContext(r),
+		sessionID,
 		userIDFromContext(r),
 		req.MediaID,
 		req.Position,
diff --git a/internal/service/progress.go b/internal/service/progress.go
index 8812c07..376ebb7 100644
--- a/internal/service/progress.go
+++ b/internal/service/progress.go
@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"codeberg.org/snonux/player/internal/clock"
@@ -24,6 +25,13 @@ func NewProgressService(store repository.ProgressServiceStore, clk clock.Clock)
 }
 
 func (s *progressService) UpdateProgress(ctx context.Context, sessionID string, userID, mediaID int64, position float64) error {
+	if sessionID == "" {
+		return errors.New("session_id required")
+	}
+	if mediaID == 0 {
+		return errors.New("media_id required")
+	}
+
 	now := s.clock.Now()
 
 	if err := s.store.UpsertProgress(ctx, &model.PlaybackProgress{
diff --git a/internal/service/progress_test.go b/internal/service/progress_test.go
index 3b95c53..85eb1b3 100644
--- a/internal/service/progress_test.go
+++ b/internal/service/progress_test.go
@@ -9,6 +9,18 @@ import (
 	"codeberg.org/snonux/player/internal/repository"
 )
 
+func TestProgressService_UpdateProgress_Validation(t *testing.T) {
+	ctx := context.Background()
+	svc := NewProgressService(&repository.MockStore{}, newMockClock())
+
+	if err := svc.UpdateProgress(ctx, "", 1, 10, 5); err == nil {
+		t.Fatal("expected error for empty sessionID")
+	}
+	if err := svc.UpdateProgress(ctx, "sess", 1, 0, 5); err == nil {
+		t.Fatal("expected error for mediaID=0")
+	}
+}
+
 func TestProgressService_UpdateProgress(t *testing.T) {
 	ctx := context.Background()