{"record":{"id":"5cfba7e1bbaed658","repo":"yikart/AiToEarn","slug":"invalid-objectid","errorCode":null,"errorMessage":"Invalid ObjectId","messagePattern":"Invalid ObjectId","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"project/aitoearn-electron/server/src/common/decorators/param-object-id.decorator.ts","lineNumber":7,"sourceCode":"import { Param, PipeTransform, BadRequestException } from '@nestjs/common';\nimport { isValidObjectId } from 'mongoose';\n\nexport class ObjectIdPipe implements PipeTransform {\n  transform(value: string) {\n    if (!isValidObjectId(value)) {\n      throw new BadRequestException('Invalid ObjectId');\n    }\n    return value;\n  }\n}\n\nexport function ParamObjectId(property: string = 'id') {\n  return Param(property, new ObjectIdPipe());\n}\n","sourceCodeStart":1,"sourceCodeEnd":16,"githubUrl":"https://github.com/yikart/AiToEarn/blob/d3aa8bea5b146a8675607cf0144d891aad3e9683/project/aitoearn-electron/server/src/common/decorators/param-object-id.decorator.ts#L1-L16","documentation":"ObjectIdPipe is a NestJS validation pipe for route parameters; it throws BadRequestException 'Invalid ObjectId' when mongoose's isValidObjectId rejects the value. It guarantees route params meant to be Mongo ObjectIds are actually 24-char hex strings before reaching the handler.","triggerScenarios":"Any route using @ParamObjectId receiving an id that is undefined, empty, non-hex, wrong length, or stringified values like 'undefined' or 'null'.","commonSituations":"Client building URLs with unset variables (/api/users/undefined); ids from a different scheme (UUIDs, numeric ids); truncated ids after URL manipulation.","solutions":["Fix the client to send a real 24-char hex ObjectId from Mongo.","Add a client-side pre-check validating id format before navigating/calling.","Check where the id originates — often an unset variable interpolated into the URL.","If the collection uses non-ObjectId ids, remove the pipe or use different validation."],"exampleFix":"// before\nfetch(`/api/records/${recordId}`);\n// after\nif (!/^[0-9a-fA-F]{24}$/.test(recordId)) return;\nfetch(`/api/records/${recordId}`);","handlingStrategy":"validation","validationCode":"const OBJECT_ID_RE = /^[0-9a-fA-F]{24}$/;\nfunction assertObjectId(id, name = 'id') {\n  if (typeof id !== 'string' || !OBJECT_ID_RE.test(id)) {\n    throw new Error(`${name} 不是有效的 ObjectId: ${id}`);\n  }\n  return id;\n}","typeGuard":"function isValidObjectId(id) {\n  return typeof id === 'string' && /^[0-9a-fA-F]{24}$/.test(id);\n}","tryCatchPattern":"try {\n  await api.get(`/records/${id}`);\n} catch (e) {\n  if (e?.response?.status === 400 && e.message === 'Invalid ObjectId') {\n    throw new Error(`传入的 id 无效: \"${id}\"，请检查数据来源`);\n  } else throw e;\n}","preventionTips":["Guard URL template strings — /x/${id} with undefined becomes '/x/undefined'.","Validate ids at the client boundary before navigation/API calls.","UUIDs and numeric ids will fail this pipe — only Mongo ObjectIds pass.","Return 24-hex ids from list endpoints so round-trips stay valid."],"tags":["mongodb","validation","nestjs","bad-request","http-400"],"backgroundTag":"invalid-objectid","analyzedSha":"d3aa8bea5b146a8675607cf0144d891aad3e9683","analyzedAt":"2026-08-31T14:19:24.185Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}