From 03187a0af214000dcf948156df0dfd9c94bdecb8 Mon Sep 17 00:00:00 2001
From: Era Dorta <era.dorta@proton.me>
Date: Mon, 6 Apr 2026 17:08:57 +0200
Subject: [PATCH] refactor: add missing checks on required fields

---
 src/api/api.go | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/src/api/api.go b/src/api/api.go
index daf7639..66ae53a 100644
--- a/src/api/api.go
+++ b/src/api/api.go
@@ -783,6 +783,16 @@ func (a *Api) CreateGroup(c *gin.Context) {
 		return
 	}
 
+	if req.Name == "" {
+		c.JSON(400, Error{Msg: "Couldn't process request - group name missing"})
+		return
+	}
+
+	if len(req.Members) == 0 {
+		c.JSON(400, Error{Msg: "Couldn't process request - group members missing"})
+		return
+	}
+
 	editGroupPermission := client.DefaultGroupPermission
 	addMembersPermission := client.DefaultGroupPermission
 	sendMessagesPermission := client.DefaultGroupPermission
@@ -866,6 +876,11 @@ func (a *Api) AddMembersToGroup(c *gin.Context) {
 		return
 	}
 
+	if len(req.Members) == 0 {
+		c.JSON(400, Error{Msg: "Couldn't process request - group members missing"})
+		return
+	}
+
 	err = a.signalClient.AddMembersToGroup(number, groupId, req.Members)
 	if err != nil {
 		switch err.(type) {
@@ -1272,6 +1287,16 @@ func (a *Api) UnpinMessageInGroup(c *gin.Context) {
 		return
 	}
 
+	if req.TargetAuthor == "" {
+		c.JSON(400, Error{Msg: "Couldn't process request - target author missing"})
+		return
+	}
+
+	if req.Timestamp == 0 {
+		c.JSON(400, Error{Msg: "Couldn't process request - timestamp missing"})
+		return
+	}
+
 	err = a.signalClient.UnpinMessageInGroup(number, groupId, req.TargetAuthor, req.Timestamp)
 	if err != nil {
 		c.JSON(400, Error{Msg: err.Error()})
@@ -2378,6 +2403,16 @@ func (a *Api) SubmitRateLimitChallenge(c *gin.Context) {
 		return
 	}
 
+	if req.ChallengeToken == "" {
+		c.JSON(400, Error{Msg: "Couldn't process request - challenge token missing"})
+		return
+	}
+
+	if req.Captcha == "" {
+		c.JSON(400, Error{Msg: "Couldn't process request - captcha missing"})
+		return
+	}
+
 	err = a.signalClient.SubmitRateLimitChallenge(number, req.ChallengeToken, req.Captcha)
 	if err != nil {
 		c.JSON(400, Error{Msg: err.Error()})