From 08efffbff109ab39fdd042a51dbe3d41fa1a82b4 Mon Sep 17 00:00:00 2001 From: Paulo Castellano Date: Sun, 9 Aug 2026 11:42:49 -0300 Subject: [PATCH] fix: guard ContentTypeMatchesPlatform against non-uuid social_account_id An MCP client sending a non-uuid social_account_id (e.g. a placeholder string) reached SocialAccount::find() directly, which threw a Postgres QueryException (22P02) instead of failing validation gracefully. --- app/Rules/ContentTypeMatchesPlatform.php | 2 +- tests/Unit/Rules/ContentTypeMatchesPlatformTest.php | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/app/Rules/ContentTypeMatchesPlatform.php b/app/Rules/ContentTypeMatchesPlatform.php index 56e945c24..fd0da853d 100644 --- a/app/Rules/ContentTypeMatchesPlatform.php +++ b/app/Rules/ContentTypeMatchesPlatform.php @@ -40,7 +40,7 @@ public function validate(string $attribute, mixed $value, Closure $fail): void $parentKey = Str::beforeLast($attribute, '.'); $accountId = data_get($this->data, $parentKey.'.social_account_id'); - if (! $accountId) { + if (! $accountId || ! Str::isUuid((string) $accountId)) { return; } diff --git a/tests/Unit/Rules/ContentTypeMatchesPlatformTest.php b/tests/Unit/Rules/ContentTypeMatchesPlatformTest.php index c3fe5352a..e5a6dedda 100644 --- a/tests/Unit/Rules/ContentTypeMatchesPlatformTest.php +++ b/tests/Unit/Rules/ContentTypeMatchesPlatformTest.php @@ -67,6 +67,14 @@ function runMatchesPlatformRule(string $contentType, ?string $accountId, array $ expect(runMatchesPlatformRule(ContentType::XPost->value, null))->toBe([]); }); +test('skips validation without querying the database when social_account_id is not a uuid', function () { + // Regression: a non-uuid social_account_id (e.g. an MCP client sending a + // placeholder string) must not reach SocialAccount::find(), which throws + // a QueryException on Postgres for invalid uuid input instead of + // returning no rows. + expect(runMatchesPlatformRule(ContentType::XPost->value, 'threads-account'))->toBe([]); +}); + test('skips validation when content_type is not a known enum value', function () { $workspace = Workspace::factory()->create(); $linkedin = SocialAccount::factory()->create([