events: validate --type and harden --limit parsing in CLI

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Arlind Ukshini 2026-04-27 10:41:37 +02:00
parent 6b5e2f1297
commit 51b0508561

View file

@ -17,6 +17,7 @@ import { q } from '../src/db.js';
const args = process.argv.slice(2); const args = process.argv.slice(2);
const cmd = args[0]; const cmd = args[0];
const EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/; const EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
const ALLOWED_EVENT_TYPES = new Set(['login', 'timeline_view']);
function help() { function help() {
console.log('Usage:'); console.log('Usage:');
@ -49,7 +50,13 @@ function metaCompact(m) {
switch (cmd) { switch (cmd) {
case 'list': { case 'list': {
const type = parseFlag('--type'); const type = parseFlag('--type');
const limit = Number(parseFlag('--limit') || 200); if (type && !ALLOWED_EVENT_TYPES.has(type)) {
console.error(`unknown --type: ${type} (valid: ${[...ALLOWED_EVENT_TYPES].join(', ')})`);
process.exit(1);
}
const rawLimit = parseFlag('--limit');
const parsedLimit = rawLimit == null ? 200 : Number.parseInt(rawLimit, 10);
const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? parsedLimit : 200;
const rows = type const rows = type
? q.listEventsByType.all(type, limit) ? q.listEventsByType.all(type, limit)
: q.listEvents.all(limit); : q.listEvents.all(limit);