fix(server): validate permission and question ids (#26456)

2026-05-09 00:20:28 -04:00
parent 8cbc43fbb0
commit dc978cb889
3 changed files with 32 additions and 3 deletions
--- a/packages/opencode/src/question/schema.ts
+++ b/packages/opencode/src/question/schema.ts
@@ -6,7 +6,7 @@ import { Newtype } from "@/util/schema"

 export class QuestionID extends Newtype<QuestionID>()(
  "QuestionID",
-  Schema.String.annotate({ [ZodOverride]: Identifier.schema("question") }),
+  Schema.String.check(Schema.isStartsWith("que")).annotate({ [ZodOverride]: Identifier.schema("question") }),
 ) {
  static ascending(id?: string): QuestionID {
    return this.make(Identifier.ascending("question", id))