fix: opravy po review

server/src/routes/groupRoutes.ts

@@ -2,7 +2,7 @@ import express, { Request } from "express";
 import { getLogin } from "../auth";
 import { parseToken } from "../utils";
 import { getWebsocket } from "../websocket";
-import { createGroup, deleteGroup, addGroupMember, removeGroupMember, updateGroupMember, setGroupState } from "../groups";
+import { createGroup, deleteGroup, addGroupMember, removeGroupMember, updateGroupMember, setGroupState, updateGroupTimes } from "../groups";
 import { GroupState } from "../../../types/gen/types.gen";
 
 const router = express.Router();
@@ -39,6 +39,9 @@ router.post("/addMember", async (req: Request, res, next) => {
     const login = getLogin(parseToken(req));
     const { id, login: targetLogin } = req.body ?? {};
     if (!id) return res.status(400).json({ error: 'Nebylo předáno ID skupiny' });
+    if (targetLogin !== undefined && (typeof targetLogin !== 'string' || targetLogin.trim() === '')) {
+        return res.status(400).json({ error: 'Neplatný login uživatele' });
+    }
     const target = targetLogin ?? login;
     try {
         const data = await addGroupMember(login, id, target);
@@ -65,10 +68,26 @@ router.post("/updateMember", async (req: Request, res, next) => {
     if (!id) return res.status(400).json({ error: 'Nebylo předáno ID skupiny' });
     if (!targetLogin) return res.status(400).json({ error: 'Nebyl předán login uživatele' });
     const patch: Record<string, any> = {};
-    if (amount !== undefined) patch.amount = amount;
-    if (note !== undefined) patch.note = note;
-    if (surchargeText !== undefined) patch.surchargeText = surchargeText;
-    if (surchargeAmount !== undefined) patch.surchargeAmount = surchargeAmount;
+    if (amount !== undefined) {
+        if (typeof amount !== 'number' || !Number.isFinite(amount) || amount < 0) {
+            return res.status(400).json({ error: 'Neplatná částka' });
+        }
+        patch.amount = amount;
+    }
+    if (note !== undefined) {
+        if (typeof note !== 'string') return res.status(400).json({ error: 'Neplatná poznámka' });
+        patch.note = note;
+    }
+    if (surchargeText !== undefined) {
+        if (typeof surchargeText !== 'string') return res.status(400).json({ error: 'Neplatný text příplatku' });
+        patch.surchargeText = surchargeText;
+    }
+    if (surchargeAmount !== undefined) {
+        if (typeof surchargeAmount !== 'number' || !Number.isFinite(surchargeAmount) || surchargeAmount < 0) {
+            return res.status(400).json({ error: 'Neplatná výše příplatku' });
+        }
+        patch.surchargeAmount = surchargeAmount;
+    }
     try {
         const data = await updateGroupMember(login, id, targetLogin, patch);
         broadcastExtra(data);
@@ -90,4 +109,22 @@ router.post("/setState", async (req: Request, res, next) => {
     } catch (e: any) { next(e); }
 });
 
+router.post("/updateTimes", async (req: Request, res, next) => {
+    const login = getLogin(parseToken(req));
+    const { id, orderedAt, deliveryAt } = req.body ?? {};
+    if (!id) return res.status(400).json({ error: 'Nebylo předáno ID skupiny' });
+    const timeRegex = /^([01]\d|2[0-3]):[0-5]\d$/;
+    if (orderedAt !== undefined && orderedAt !== '' && !timeRegex.test(orderedAt)) {
+        return res.status(400).json({ error: 'Neplatný formát času objednání (očekáváno HH:MM)' });
+    }
+    if (deliveryAt !== undefined && deliveryAt !== '' && !timeRegex.test(deliveryAt)) {
+        return res.status(400).json({ error: 'Neplatný formát času doručení (očekáváno HH:MM)' });
+    }
+    try {
+        const data = await updateGroupTimes(login, id, orderedAt, deliveryAt);
+        broadcastExtra(data);
+        res.status(200).json(data);
+    } catch (e: any) { next(e); }
+});
+
 export default router;