From a1e4841504152af55d25a6b7a5c6c57a782d16b4 Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Mon, 4 May 2026 08:44:59 +0300
Subject: task f: validate media_id and sessionID in progress handler and
 service

---
 internal/api/handlers_media.go    |  7 ++++++-
 internal/service/progress.go      |  8 ++++++++
 internal/service/progress_test.go | 12 ++++++++++++
 3 files changed, 26 insertions(+), 1 deletion(-)

(limited to 'internal')

diff --git a/internal/api/handlers_media.go b/internal/api/handlers_media.go
index c986eb3..c761bce 100644
--- a/internal/api/handlers_media.go
+++ b/internal/api/handlers_media.go
@@ -457,9 +457,14 @@ func (s *Server) handleProgress(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "media_id required"})
 		return
 	}
+	sessionID := sessionIDFromContext(r)
+	if sessionID == "" {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "session required"})
+		return
+	}
 	err := s.progressSvc.UpdateProgress(
 		r.Context(),
-		sessionIDFromContext(r),
+		sessionID,
 		userIDFromContext(r),
 		req.MediaID,
 		req.Position,
diff --git a/internal/service/progress.go b/internal/service/progress.go
index 8812c07..376ebb7 100644
--- a/internal/service/progress.go
+++ b/internal/service/progress.go
@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"codeberg.org/snonux/player/internal/clock"
@@ -24,6 +25,13 @@ func NewProgressService(store repository.ProgressServiceStore, clk clock.Clock)
 }
 
 func (s *progressService) UpdateProgress(ctx context.Context, sessionID string, userID, mediaID int64, position float64) error {
+	if sessionID == "" {
+		return errors.New("session_id required")
+	}
+	if mediaID == 0 {
+		return errors.New("media_id required")
+	}
+
 	now := s.clock.Now()
 
 	if err := s.store.UpsertProgress(ctx, &model.PlaybackProgress{
diff --git a/internal/service/progress_test.go b/internal/service/progress_test.go
index 3b95c53..85eb1b3 100644
--- a/internal/service/progress_test.go
+++ b/internal/service/progress_test.go
@@ -9,6 +9,18 @@ import (
 	"codeberg.org/snonux/player/internal/repository"
 )
 
+func TestProgressService_UpdateProgress_Validation(t *testing.T) {
+	ctx := context.Background()
+	svc := NewProgressService(&repository.MockStore{}, newMockClock())
+
+	if err := svc.UpdateProgress(ctx, "", 1, 10, 5); err == nil {
+		t.Fatal("expected error for empty sessionID")
+	}
+	if err := svc.UpdateProgress(ctx, "sess", 1, 0, 5); err == nil {
+		t.Fatal("expected error for mediaID=0")
+	}
+}
+
 func TestProgressService_UpdateProgress(t *testing.T) {
 	ctx := context.Background()
 
-- 
cgit v1.2.3