fix coverage facet contract validation

Author: eliperez-dev

frontend/src/api/FacetsRepository.ts

@@ -9,6 +9,11 @@ export type FacetResponse = Readonly<{ profile: LocalProfile; releaseId: string;
 const fail = (kind: ApiError['kind'], message: string): ApiError => Object.assign(new Error(message), { kind });
 export type FacetFilters = Readonly<{ country_code?: string | undefined; region?: string | undefined; category?: string | undefined; source_type?: string | undefined; display_precision?: string | undefined; lifecycle_status?: string | undefined }>;
 
+const normalizedFilter = (value: string | null | undefined): string | null => {
+  const normalized = value?.trim();
+  return normalized ? normalized : null;
+};
+
 export class FacetsRepository {
   constructor(private readonly fetcher: FetchLike = globalThis.fetch, private readonly baseUrl = '') {}
   async get(profile: LocalProfile, filters: FacetFilters, expected: { releaseId: string; ruleset: string }, signal?: AbortSignal): Promise<FacetResponse> {
@@ -18,9 +23,15 @@ export class FacetsRepository {
     try { const init: RequestInit = { cache: 'no-store' }; if (signal) init.signal = signal; response = await this.fetcher.call(globalThis, `${this.baseUrl}/api/v2/discovery/facets?${params}`, init); }
     catch (error) { if (error instanceof DOMException && error.name === 'AbortError') throw fail('aborted', 'Facet request was aborted.'); throw fail('network', 'Coverage summary could not connect to the V2 service.'); }
     if (!response.ok) throw fail(response.status >= 500 ? 'unavailable' : response.status === 429 ? 'rate-limited' : 'http', `Coverage summary request failed with status ${response.status}.`);
-    const parsed = responseSchema.safeParse(await response.json());
+    let payload: unknown;
+    try { payload = await response.json(); } catch { throw fail('invalid-contract', 'Coverage summary response was not valid JSON.'); }
+    const parsed = responseSchema.safeParse(payload);
     if (!parsed.success) throw fail('invalid-contract', 'Coverage summary response was rejected safely.');
     if (parsed.data.meta.profile !== profile || parsed.data.meta.release_id !== expected.releaseId || parsed.data.meta.ruleset_version !== expected.ruleset) throw fail('invalid-contract', 'Coverage summary belongs to a different profile or promoted release.');
+    const responseFilters = parsed.data.meta.filters;
+    for (const key of ['country_code', 'region', 'category', 'source_type', 'display_precision', 'lifecycle_status'] as const) {
+      if (normalizedFilter(filters[key]) !== normalizedFilter(responseFilters[key])) throw fail('invalid-contract', 'Coverage summary belongs to a different filter scope.');
+    }
     return { profile, releaseId: parsed.data.meta.release_id, ruleset: parsed.data.meta.ruleset_version, coverageScope: parsed.data.meta.coverage_scope, countSemantics: parsed.data.meta.count_semantics, dimensions: parsed.data.dimensions };
   }
 }

frontend/tests/unit/facetsRepository.test.ts

@@ -15,4 +15,19 @@ describe('FacetsRepository', () => {
     const fetcher = vi.fn().mockResolvedValue(new Response(JSON.stringify(body({ meta: { ...body().meta, release_id: 'old-release' } }))));
     await expect(new FacetsRepository(fetcher).get('official', {}, { releaseId: 'release-1', ruleset: 'rules-1' })).rejects.toThrow(/different profile or promoted release/);
   });
+
+  it('rejects a facet snapshot from a different requested filter scope', async () => {
+    const fetcher = vi.fn().mockResolvedValue(new Response(JSON.stringify(body({ meta: { ...body().meta, filters: { ...body().meta.filters, category: 'slaughter' } } }))));
+    await expect(new FacetsRepository(fetcher).get('official', { category: 'dairy' }, { releaseId: 'release-1', ruleset: 'rules-1' })).rejects.toMatchObject({ kind: 'invalid-contract' });
+  });
+
+  it('accepts normalized filter metadata from the backend', async () => {
+    const fetcher = vi.fn().mockResolvedValue(new Response(JSON.stringify(body({ meta: { ...body().meta, filters: { ...body().meta.filters, region: 'North Coast' } } }))));
+    await expect(new FacetsRepository(fetcher).get('official', { region: '  North Coast  ' }, { releaseId: 'release-1', ruleset: 'rules-1' })).resolves.toMatchObject({ releaseId: 'release-1' });
+  });
+
+  it('classifies malformed successful JSON as an invalid contract', async () => {
+    const fetcher = vi.fn().mockResolvedValue(new Response('{not-json'));
+    await expect(new FacetsRepository(fetcher).get('official', {}, { releaseId: 'release-1', ruleset: 'rules-1' })).rejects.toMatchObject({ kind: 'invalid-contract' });
+  });
 });