Commit 4f469c7
committed
fix(providers): wire the LinkedIn and Moltbook settings DTOs
validatePosts runs settings-DTO validation only when the provider
declares `dto`. LinkedinProvider and MoltbookProvider never did, so for
linkedin, linkedin-page (inherits from LinkedinProvider) and moltbook
that validation layer silently did not run: LinkedinDto and MoltbookDto
existed but were unwired, and any malformed or missing settings value
was accepted and stored.
The dashboard never hits this (its form validates client-side with the
same DTO classes), but the public API (POST /public/v1/posts,
PUT /public/v1/posts/:id/settings) and the agent/MCP tools share
validatePosts and were unprotected - an API caller's typo or an
LLM-guessed settings value was accepted with a 200. The cost surfaced
later instead: a moltbook post without submolt silently publishes to
the "general" community (provider falls back to it), and a truthy
non-boolean carousel value on LinkedIn fails at publish time on a post
the user was told was valid.
Declare `dto = LinkedinDto` on LinkedinProvider (LinkedinPageProvider
inherits it) and `dto = MoltbookDto` on MoltbookProvider, so bad values
are rejected at save time with a specific message (400 / {errors}).
Audited all providers: these were the only unwired settings DTOs.1 parent 013db1d commit 4f469c7
2 files changed
Lines changed: 3 additions & 0 deletions
Lines changed: 1 addition & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
58 | 58 | | |
59 | 59 | | |
60 | 60 | | |
| 61 | + | |
61 | 62 | | |
62 | 63 | | |
63 | 64 | | |
| |||
Lines changed: 2 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
6 | 6 | | |
7 | 7 | | |
8 | 8 | | |
| 9 | + | |
9 | 10 | | |
10 | 11 | | |
11 | 12 | | |
| |||
15 | 16 | | |
16 | 17 | | |
17 | 18 | | |
| 19 | + | |
18 | 20 | | |
19 | 21 | | |
20 | 22 | | |
| |||
0 commit comments