fix(bug): number id parse issue

[hemantch01]

Description

Fixes #162

this pr resolves a vulnerability where numeric :id route parameters were partially parsed due to the use of parseInt(). For example, requests like GET /templates/1abc were incorrectly truncated and executed as GET /templates/1, potentially leading to unexpected resource modification or deletion.

Tests passed

Postman screenshot after FIX

[github-actions]

This PR is stale because it has been open 15 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[github-actions]

This PR is stale because it has been open with no activity. Remove the stale label or comment to keep it active. Only items with maintainer engagement are auto-closed.

[hemantch01]

hi @mttrbrts any feedback?

[Copilot]

Pull request overview

Fixes a vulnerability where numeric :id route parameters were partially parsed via parseInt() (e.g. /templates/1abc resolving to /templates/1). The PR switches to Number() and rejects non-numeric IDs with a 400 response.

Changes:

• In buildCrudRouter, replace parseInt with Number for GET/PUT/DELETE /:id and return 400 Invalid ID format when the parsed value is NaN (skipped for UUID PKs).
• In resolveAgreement, replace Number.parseInt with Number and throw on NaN before querying the DB.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
server/handlers/crud.ts	Adds strict numeric ID validation and switches parseInt to Number in the three /:id CRUD handlers.
server/handlers/agreements.ts	Applies the same strict numeric parsing/validation in resolveAgreement.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.