fix(gateway): reject malformed restart request params

vincentkoc · vincentkoc · commit 108d6d7eca00 · 2026-06-21T23:28:53.000+02:00
diff --git a/src/gateway/server-methods/restart.test.ts b/src/gateway/server-methods/restart.test.ts
@@ -1,6 +1,6 @@
 // Restart method tests cover safe restart scheduling, deferral flags, and
 // response payloads returned by gateway.restart.request.
-import { describe, expect, it, vi } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 import { restartHandlers } from "./restart.js";
 
 const requestSafeGatewayRestart = vi.hoisted(() => vi.fn());
@@ -21,7 +21,7 @@ vi.mock("../../infra/restart-coordinator.js", () => ({
   requestSafeGatewayRestart: (opts: unknown) => requestSafeGatewayRestart(opts),
 }));
 
-function invokeRestartRequest(params: Record<string, unknown>) {
+function invokeRestartRequest(params: unknown) {
   const respond = vi.fn();
   const handler = restartHandlers["gateway.restart.request"];
   return Promise.resolve(
@@ -59,6 +59,10 @@ function expectRestartRequest(skipDeferral: boolean) {
 }
 
 describe("gateway.restart.request handler", () => {
+  beforeEach(() => {
+    requestSafeGatewayRestart.mockClear();
+  });
+
   it("defaults to skipDeferral: false when the param is absent", async () => {
     mockScheduledRestart({ safe: true, summary: "safe to restart now" });
 
@@ -90,4 +94,36 @@ describe("gateway.restart.request handler", () => {
 
     expectRestartRequest(false);
   });
+
+  it("rejects non-object params without scheduling a restart", async () => {
+    const respond = await invokeRestartRequest("operator");
+
+    expect(requestSafeGatewayRestart).not.toHaveBeenCalled();
+    expect(respond.mock.calls).toEqual([
+      [
+        false,
+        undefined,
+        {
+          code: "INVALID_REQUEST",
+          message: "invalid gateway.restart.request params",
+        },
+      ],
+    ]);
+  });
+
+  it("rejects array params without scheduling a restart", async () => {
+    const respond = await invokeRestartRequest([]);
+
+    expect(requestSafeGatewayRestart).not.toHaveBeenCalled();
+    expect(respond.mock.calls).toEqual([
+      [
+        false,
+        undefined,
+        {
+          code: "INVALID_REQUEST",
+          message: "invalid gateway.restart.request params",
+        },
+      ],
+    ]);
+  });
 });
diff --git a/src/gateway/server-methods/restart.ts b/src/gateway/server-methods/restart.ts
@@ -1,10 +1,15 @@
 // Gateway RPC handlers for safe gateway restart requests and preflight state.
+import { ErrorCodes, errorShape } from "../../../packages/gateway-protocol/src/index.js";
 import {
   createSafeGatewayRestartPreflight,
   requestSafeGatewayRestart,
 } from "../../infra/restart-coordinator.js";
 import type { GatewayRequestHandlers } from "./types.js";
 
+function isRestartRequestParams(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 function normalizeReason(value: unknown): string | undefined {
   // Restart reasons are operator-visible log context, not payload storage.
   // Trim and cap them before passing through to the coordinator.
@@ -20,6 +25,14 @@ function normalizeSkipDeferral(value: unknown): boolean {
 /** Gateway request handlers for safe restart coordination. */
 export const restartHandlers: GatewayRequestHandlers = {
   "gateway.restart.request": async ({ respond, params }) => {
+    if (!isRestartRequestParams(params)) {
+      respond(
+        false,
+        undefined,
+        errorShape(ErrorCodes.INVALID_REQUEST, "invalid gateway.restart.request params"),
+      );
+      return;
+    }
     const result = requestSafeGatewayRestart({
       reason: normalizeReason(params.reason),
       delayMs: 0,
