Task: Validate Key parameter at runtime in admin

apps/api/src/app/admin/admin.controller.ts

@@ -29,7 +29,11 @@ import {
   ScraperConfiguration
 } from '@ghostfolio/common/interfaces';
 import { permissions } from '@ghostfolio/common/permissions';
-import type { DateRange, RequestWithUser } from '@ghostfolio/common/types';
+import type {
+  DateRange,
+  PropertyKey,
+  RequestWithUser
+} from '@ghostfolio/common/types';
 
 import {
   Body,
@@ -55,6 +59,7 @@ import { isDate, parseISO } from 'date-fns';
 import { StatusCodes, getReasonPhrase } from 'http-status-codes';
 
 import { AdminService } from './admin.service';
+import { PropertyKeyPipe } from './pipes/property-key.pipe';
 
 @Controller('admin')
 export class AdminController {
@@ -310,7 +315,7 @@ export class AdminController {
   @Put('settings/:key')
   @UseGuards(AuthGuard('jwt'), HasPermissionGuard)
   public async updateProperty(
-    @Param('key') key: string,
+    @Param('key', PropertyKeyPipe) key: PropertyKey,
     @Body() data: UpdatePropertyDto
   ) {
     return this.adminService.putSetting(key, data.value);

apps/api/src/app/admin/admin.service.ts

@@ -344,17 +344,17 @@ export class AdminService {
     }
   }
 
-  public async putSetting(key: string, value: string) {
+  public async putSetting(key: PropertyKey, value: string) {
     let response: Property;
 
     if (value) {
       response = await this.propertyService.put({
         value,
-        key: key as PropertyKey
+        key
       });
     } else {
       response = await this.propertyService.delete({
-        key: key as PropertyKey
+        key
       });
     }
 

apps/api/src/app/admin/pipes/property-key.pipe.ts

@@ -0,0 +1,25 @@
+import * as config from '@ghostfolio/common/config';
+import type { PropertyKey } from '@ghostfolio/common/types';
+
+import { BadRequestException, Injectable, PipeTransform } from '@nestjs/common';
+
+@Injectable()
+export class PropertyKeyPipe implements PipeTransform<string, PropertyKey> {
+  private readonly allowedKeys: Set<string>;
+
+  public constructor() {
+    this.allowedKeys = new Set(
+      Object.entries(config)
+        .filter(([key]) => key.startsWith('PROPERTY_'))
+        .map(([, value]) => value as string)
+    );
+  }
+
+  public transform(value: string): PropertyKey {
+    if (!this.allowedKeys.has(value)) {
+      throw new BadRequestException(`Invalid property key: ${value}`);
+    }
+
+    return value as PropertyKey;
+  }
+}