Harden validation of accounts and tags in endpoints with filters

apps/api/src/app/endpoints/mcp/mcp.controller.ts

@@ -175,7 +175,7 @@ export class GhostfolioMcpController {
     }: z.infer<typeof GET_ACCOUNTS_PARAMETERS>
   ) {
     const filters = this.apiService.buildFiltersFromQueryParams({
-      filterByAccounts: accountIds?.join(','),
+      filterByAccounts: accountIds,
       filterByAssetClasses: assetClasses,
       filterByDataSource: holding?.dataSource,
       filterBySymbol: holding?.symbol

apps/api/src/dtos/filter.dto.ts

@@ -1,12 +1,15 @@
 import { AssetClass, DataSource } from '@prisma/client';
 import { Transform, TransformFnParams } from 'class-transformer';
-import { IsEnum, IsOptional, IsString } from 'class-validator';
+import { IsEnum, IsOptional, IsString, IsUUID } from 'class-validator';
 import { isString } from 'lodash';
 
 export class FilterDto {
   @IsOptional()
-  @IsString()
+  @IsUUID(undefined, { each: true })
-  accounts?: string;
+  @Transform(({ value }: TransformFnParams) => {
+    return isString(value) ? value.split(',') : value;
+  })
+  accounts?: string[];
 
   @IsEnum(AssetClass, { each: true })
   @IsOptional()
@@ -24,6 +27,9 @@ export class FilterDto {
   symbol?: string;
 
   @IsOptional()
-  @IsString()
+  @IsUUID(undefined, { each: true })
-  tags?: string;
+  @Transform(({ value }: TransformFnParams) => {
+    return isString(value) ? value.split(',') : value;
+  })
+  tags?: string[];
 }

apps/api/src/services/api/api.service.ts

@@ -14,23 +14,23 @@ export class ApiService {
     filterBySymbol,
     filterByTags
   }: {
-    filterByAccounts?: string;
+    filterByAccounts?: string[];
     filterByAssetClasses?: string[];
     filterByAssetSubClasses?: string;
     filterByDataSource?: string;
     filterByHoldingType?: string;
     filterBySearchQuery?: string;
     filterBySymbol?: string;
-    filterByTags?: string;
+    filterByTags?: string[];
   }): Filter[] {
-    const accountIds = filterByAccounts?.split(',') ?? [];
+    const accountIds = filterByAccounts ?? [];
     const assetClasses = filterByAssetClasses ?? [];
     const assetSubClasses = filterByAssetSubClasses?.split(',') ?? [];
     const dataSource = filterByDataSource;
     const holdingType = filterByHoldingType;
     const searchQuery = filterBySearchQuery?.toLowerCase();
     const symbol = filterBySymbol;
-    const tagIds = filterByTags?.split(',') ?? [];
+    const tagIds = filterByTags ?? [];
 
     const filters = [
       ...accountIds.map((accountId) => {
@@ -96,11 +96,11 @@ export class ApiService {
     userSettings: UserSettings;
   }): Filter[] {
     return this.buildFiltersFromQueryParams({
-      filterByAccounts: userSettings?.['filters.accounts']?.[0],
+      filterByAccounts: userSettings?.['filters.accounts'],
       filterByAssetClasses: userSettings?.['filters.assetClasses'],
       filterByDataSource: userSettings?.['filters.dataSource'],
       filterBySymbol: userSettings?.['filters.symbol'],
-      filterByTags: userSettings?.['filters.tags']?.[0]
+      filterByTags: userSettings?.['filters.tags']
     });
   }
 }