Security: Missing TypeBox params schema on GET/PATCH/DELETE /ingest/:ingestId routes

[LucasMaupin]

Summary

All three /ingest/:ingestId route handlers in src/api_ingests.ts declare Params: { ingestId: string } as a TypeScript generic but do not include params: Type.Object(...) in the Fastify schema block. Fastify therefore performs no runtime validation or coercion on ingestId — it is passed directly to parseInt(ingestId, 10) without any pattern or length check.

Affected File

src/api_ingests.ts:

• GET /api/v1/ingests/:ingestId (~line 134)
• PATCH /api/v1/ingests/:ingestId (~line 173)
• DELETE /api/v1/ingests/:ingestId (~line 246)

Impact

• Any string (including empty, oversized, or special characters) is accepted as ingestId and passed to parseInt, which silently returns NaN and can cause unpredictable downstream behaviour.
• AJV does not enforce the TypeScript type at runtime — only the schema block is evaluated.

Severity

Medium

Fix

Add a params entry to each affected route's schema block:

schema: {
  params: Type.Object({
    ingestId: Type.String({ minLength: 1, pattern: '^[0-9]+$' }),
  }),
  // ... existing response schema
},

Related

• Security: WHIP/WHEP OPTIONS handlers missing TypeBox params schema — path params unvalidated #249 — similar schema gap on WHIP/WHEP OPTIONS handlers (different routes)