Description
The /api/notify POST endpoint has several gaps compared to other API routes in the project:
Problems
-
No rate limiting — Unlike /api/track-user which uses trackUserRateLimiter, the notify endpoint has no rate limiting, allowing spam of email registrations.
-
No Zod validation — Uses manual if (!username || !email) validation instead of Zod schemas, which is inconsistent with all other API routes that use Zod.
-
No MONGODB_URI graceful degradation — When MONGODB_URI is unset, it will crash with an unhandled error. Compare with /api/track-user which handles this explicitly.
-
No GitHub username format validation — The username field is not validated against GITHUB_USERNAME_REGEX.
-
Missing from middleware matcher — The endpoint is not listed in the middleware matcher (middleware.ts lines 57-63), so it also bypasses the global per-IP rate limiter.
Expected behavior
- Add rate limiting consistent with other endpoints
- Migrate to Zod schema validation using
githubParamsSchema or a similar schema
- Add graceful handling when
MONGODB_URI is not configured
- Validate GitHub username format
- Add the route to the middleware matcher
Files
app/api/notify/route.tsmiddleware.ts (matcher config)
Description
The
/api/notifyPOST endpoint has several gaps compared to other API routes in the project:Problems
No rate limiting — Unlike
/api/track-userwhich usestrackUserRateLimiter, the notify endpoint has no rate limiting, allowing spam of email registrations.No Zod validation — Uses manual
if (!username || !email)validation instead of Zod schemas, which is inconsistent with all other API routes that use Zod.No MONGODB_URI graceful degradation — When
MONGODB_URIis unset, it will crash with an unhandled error. Compare with/api/track-userwhich handles this explicitly.No GitHub username format validation — The
usernamefield is not validated againstGITHUB_USERNAME_REGEX.Missing from middleware matcher — The endpoint is not listed in the middleware matcher (
middleware.tslines 57-63), so it also bypasses the global per-IP rate limiter.Expected behavior
githubParamsSchemaor a similar schemaMONGODB_URIis not configuredFiles
app/api/notify/route.tsmiddleware.ts(matcher config)