[PR #5913] [MERGED] fix(backend): prevent request payload from overriding id and name #5412

New issue

Closed

opened 2026-03-17 02:51:45 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:51:45 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5913
Author: @mirarifhasan
Created: 2/27/2026
Status: ✅ Merged
Merged: 3/2/2026
Merged by: @jamesgeorge007

Base: patch ← Head: hotfix/db-id-override

📝 Commits (2)

1a48e37 fix: cast and spread request before id and name
18b0521 test(backend): add tests for exportUserCollectionToJSONObject id/name precedence

📊 Changes

2 files changed (+68 additions, -2 deletions)

View changed files

📝 packages/hoppscotch-backend/src/user-collection/user-collection.service.spec.ts (+66 -0)
📝 packages/hoppscotch-backend/src/user-collection/user-collection.service.ts (+2 -2)

📄 Description

Closes BE-729.

What's changed

Reorder the spread in the request mapping so id and name are assigned after spreading x.request, preventing the stored request JSON payload from overriding the authoritative DB row values and applied to both export paths in exportUserCollectionToJSONObject and exportUserCollectionsToJSON.

Also fixes constructor brace formatting and adds regression tests.

Notes to reviewers

exportUserCollectionToJSONObject is called on every personal workspace page load and not only on explicit collection exports. Users who duplicated requests before the #5781 fix (v2026.1.1) have rows where the stored request JSON contains the original request's id. Without this fix, the wrong id is served to the frontend on reload, causing delete/rename/edit operations to target the wrong row. This resolves the stuck-duplicate-after-upgrade regression reported post v2026.1.1.

Summary by cubic

Fixes request mapping so a stored request payload can’t override id and name, ensuring correct identifiers in collection exports. Addresses BE-729.

Bug Fixes
- Spread cast request before setting id/name in both mappings; add tests for id/name precedence and USER_COLL_NOT_FOUND on invalid collectionID.
- Cast Prisma.JSONValue to Record<string, unknown> to safely spread.

^{Written for commit 18b05213e3. Summary will update on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5913 **Author:** [@mirarifhasan](https://github.com/mirarifhasan) **Created:** 2/27/2026 **Status:** ✅ Merged **Merged:** 3/2/2026 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `patch` ← **Head:** `hotfix/db-id-override` --- ### 📝 Commits (2) - [`1a48e37`](https://github.com/hoppscotch/hoppscotch/commit/1a48e377862cb7e48557bba5ed1c30bdb29fa04a) fix: cast and spread request before id and name - [`18b0521`](https://github.com/hoppscotch/hoppscotch/commit/18b05213e3898ffd4853fb5469cdefcb2ff6696d) test(backend): add tests for `exportUserCollectionToJSONObject` id/name precedence ### 📊 Changes **2 files changed** (+68 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `packages/hoppscotch-backend/src/user-collection/user-collection.service.spec.ts` (+66 -0) 📝 `packages/hoppscotch-backend/src/user-collection/user-collection.service.ts` (+2 -2) </details> ### 📄 Description   Closes BE-729.  ### What's changed Reorder the spread in the request mapping so `id` and `name` are assigned after spreading `x.request`, preventing the stored request JSON payload from overriding the authoritative DB row values and applied to both export paths in `exportUserCollectionToJSONObject` and `exportUserCollectionsToJSON`. Also fixes constructor brace formatting and adds regression tests. ### Notes to reviewers `exportUserCollectionToJSONObject` is called on every personal workspace page load and not only on explicit collection exports. Users who duplicated requests before the #5781 fix (v2026.1.1) have rows where the stored `request` JSON contains the original request's `id`. Without this fix, the wrong `id` is served to the frontend on reload, causing delete/rename/edit operations to target the wrong row. This resolves the stuck-duplicate-after-upgrade regression reported post `v2026.1.1`.  --- ## Summary by cubic Fixes request mapping so a stored request payload can’t override id and name, ensuring correct identifiers in collection exports. Addresses BE-729. - **Bug Fixes** - Spread cast request before setting id/name in both mappings; add tests for id/name precedence and USER_COLL_NOT_FOUND on invalid collectionID. - Cast Prisma.JSONValue to Record<string, unknown> to safely spread. <sup>Written for commit 18b05213e3898ffd4853fb5469cdefcb2ff6696d. Summary will update on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>