DX-2769: reject empty id in single-resource endpoints

[CahidArda]

Summary

Same class of bug as the qstash-js fix. An empty single-id string was either
joined into the path as a trailing slash (path-collapse, e.g. v2/waiters/) or
wrapped into a bulk filter (dlqIds= / workflowRunIds=) with an empty value,
both of which the server resolves to a collection/bulk operation.

This adds an assertNonEmptyId guard so an empty id throws before any request.

Changes

• Add assertNonEmptyId(id, label) helper in src/client/utils.ts
• Guard single-id entry points:
  • client.cancel (string form)
  • makeNotifyRequest (eventId), makeGetWaitersRequest (eventId)
  • dlq: delete, resume, restart (string forms), retryFailureFunction

Testing

• 7 new guard tests using mockQStashServer with receivesRequest: false.
• tsc and eslint clean.

[linear-code]

DX-2769

[Copilot]

Pull request overview

This PR adds a defensive guard to prevent empty single-resource identifiers from being sent to the Workflow/QStash API, avoiding cases where "" becomes a trailing slash path segment or an empty bulk filter value that the server can interpret as a collection/bulk operation.

Changes:

• Introduce assertNonEmptyId(id, label) in src/client/utils.ts and apply it to several single-id entry points.
• Add guards to client.cancel (string form), notify/getWaiters eventId requests, and DLQ single-id operations.
• Add tests intended to verify that no HTTP request is sent when ids are empty.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/client/utils.ts	Adds assertNonEmptyId and uses it in notify/getWaiters request builders.
src/client/index.ts	Guards cancel(string) with assertNonEmptyId.
src/client/index.test.ts	Adds tests for empty-id guards on cancel/notify/getWaiters.
src/client/dlq.ts	Guards DLQ single-id operations with assertNonEmptyId.
src/client/dlq.test.ts	Adds tests for empty-id guards on DLQ operations.

Comments suppressed due to low confidence (7)

src/client/dlq.ts:186

• resume still allows empty ids via (1) the deprecated { dlqId } overload and (2) WorkflowDLQActionFilters with dlqIds: "" / dlqIds: [""]. Those cases can still produce dlqIds= and be interpreted as a bulk operation. Validate all dlqIds in both legacy and new code paths.

        path: ["v2", "workflows", "dlq", "resume"],
        query: { dlqIds },
        method: "POST",
        headers: buildResumeRestartHeaders({ flowControl, retries }),
      });

src/client/dlq.ts:268

• restart still allows empty ids via the deprecated { dlqId } overload and via WorkflowDLQActionFilters with empty dlqIds values ("" / [""]). Validate all dlqIds before sending the request.

        path: ["v2", "workflows", "dlq", "restart"],
        query: { dlqIds },
        method: "POST",
        headers: buildResumeRestartHeaders({ flowControl, retries }),
      });

src/client/dlq.ts:328

• Only the string overload is validated. delete([""]) or delete({ dlqIds: "" | [""] }) can still send dlqIds= which may be interpreted server-side as a bulk operation. Validate all dlqIds in the normalized filters object.

   *
   * ```ts
   * let cursor: string | undefined;
   * do {
   *   const result = await client.dlq.delete({ all: true, count: 100, cursor });

src/client/dlq.test.ts:263

• The execute callback doesn’t return/await the .rejects assertion, so the test may pass without asserting the rejection.

        execute: async () => {
          const result = await client.dlq.resume(dlqIds);
          expect(result).toEqual({ cursor: undefined, workflowRuns: responses });

src/client/dlq.test.ts:518

• The execute callback doesn’t return/await the .rejects assertion, so the test may pass without actually validating the rejection.

        execute: async () => {
          const result = await client.dlq.restart(dlqIds);
          expect(result).toEqual({ cursor: undefined, workflowRuns: responses });

src/client/dlq.test.ts:713

• The execute callback doesn’t return/await the .rejects assertion, so the rejection may not be asserted reliably.

    });
  });

  describe("retryFailureFunction", () => {
    test("should retry failure function of a DLQ message", async () => {

src/client/dlq.test.ts:778

• The execute callback doesn’t return/await the .rejects assertion, so the test may pass without asserting the rejection.

        execute: async () => {
          const result = await client.dlq.delete(dlqIds);
          expect(result.deleted).toBe(deleted);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.