From 8c1f49765aee8cf7bc4d20924537a9d7128b0741 Mon Sep 17 00:00:00 2001
From: Wibias <37517432+Wibias@users.noreply.github.com>
Date: Sat, 15 Aug 2026 00:15:30 +0200
Subject: [PATCH 1/2] fix(lab): validate management read filters

---
 src/server/management/lab-routes.ts | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/server/management/lab-routes.ts b/src/server/management/lab-routes.ts
index 5c0929e47f..6286a2908a 100644
--- a/src/server/management/lab-routes.ts
+++ b/src/server/management/lab-routes.ts
@@ -14,6 +14,7 @@
  */
 
 import {
+  ARTIFACT_CLASSES,
   EVIDENCE_LAYERS,
   EXECUTION_MODES,
   EVENT_KINDS,
@@ -323,9 +324,10 @@ export async function handleLabRoutes(ctx: ManagementContext): Promise<Response
     const eventKind = parseEventKind(url.searchParams.get("eventKind"), ctx);
     if (eventKind instanceof Response) return eventKind;
     const excludedRaw = url.searchParams.get("excluded");
-    let excluded: boolean | undefined;
-    if (excludedRaw === "true") excluded = true;
-    else if (excludedRaw === "false") excluded = false;
+    if (excludedRaw !== null && excludedRaw !== "true" && excludedRaw !== "false") {
+      return errorResponse("invalid_excluded", "excluded must be true or false", 400, ctx);
+    }
+    const excluded = excludedRaw === "true" ? true : excludedRaw === "false" ? false : undefined;
     try {
       const page = queryLabEvents({
         eventKind,
@@ -367,6 +369,14 @@ export async function handleLabRoutes(ctx: ManagementContext): Promise<Response
     if (statusRaw && !["present", "corrupt", "purged_unavailable"].includes(statusRaw)) {
       return errorResponse("invalid_status", "status must be present, corrupt, or purged_unavailable", 400, ctx);
     }
+    if (artifactClass && !ARTIFACT_CLASSES.includes(artifactClass as (typeof ARTIFACT_CLASSES)[number])) {
+      return errorResponse(
+        "invalid_artifact_class",
+        "artifactClass must be a supported artifact class",
+        400,
+        ctx,
+      );
+    }
     try {
       const page = queryLabArtifacts({
         status: statusRaw as "present" | "corrupt" | "purged_unavailable" | undefined,

From 118c90f97be5dd14604574440aa8a915536974bc Mon Sep 17 00:00:00 2001
From: Wibias <37517432+Wibias@users.noreply.github.com>
Date: Sat, 15 Aug 2026 00:15:41 +0200
Subject: [PATCH 2/2] test(lab): cover invalid management read filters

---
 tests/lab-read-filter-validation.test.ts | 29 ++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 tests/lab-read-filter-validation.test.ts

diff --git a/tests/lab-read-filter-validation.test.ts b/tests/lab-read-filter-validation.test.ts
new file mode 100644
index 0000000000..48d93eaa0f
--- /dev/null
+++ b/tests/lab-read-filter-validation.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, test } from "bun:test";
+import type { OcxConfig } from "../src/types";
+import { handleManagementAPI } from "../src/server/management-api";
+import { ManagementRequest } from "./helpers/management-auth";
+
+const config = { providers: {} } as OcxConfig;
+
+async function apiGet(path: string): Promise<Response> {
+  const req = new ManagementRequest(`http://127.0.0.1${path}`, { method: "GET" });
+  const response = await handleManagementAPI(req, new URL(req.url), config);
+  expect(response).not.toBeNull();
+  return response!;
+}
+
+describe("Compatibility Lab management read filter validation", () => {
+  test("rejects invalid excluded values instead of silently dropping the filter", async () => {
+    const response = await apiGet("/api/lab/events?excluded=maybe");
+    expect(response.status).toBe(400);
+    const body = await response.json() as { error: { code: string } };
+    expect(body.error.code).toBe("invalid_excluded");
+  });
+
+  test("rejects unsupported artifact classes instead of querying with arbitrary values", async () => {
+    const response = await apiGet("/api/lab/artifacts?artifactClass=not-real");
+    expect(response.status).toBe(400);
+    const body = await response.json() as { error: { code: string } };
+    expect(body.error.code).toBe("invalid_artifact_class");
+  });
+});