fix(api): validate tenantId and environment in BlobTemplateStore.load

[patoperpetua]

Summary

• Add validateTenantId and validateEnvironment guards to BlobTemplateStore.load, matching the publisher's assertSafeTenantId / assertSafeEnvironment rules
• Reject unsafe values with TemplateStoreError (INVALID_TEMPLATE) before any blob storage access
• Invert the security spec's "known gap" tests to assert rejection and add coverage for additional unsafe tenantId shapes

Test plan

• pnpm test in apps/api — all 166 tests pass
• Security spec confirms no blob calls are made for slash-bearing tenantId, invalid environment, or malformed tenantId values

Closes #59

Made with Cursor

Summary by CodeRabbit

• Bug Fixes
  • Improved template loading validation for tenant and environment identifiers.
  • Invalid, empty, traversal-based, or otherwise unsafe identifiers are rejected before any template data is accessed.
  • Only supported environments—development, staging, and production—are accepted.
  • Invalid template requests now return a consistent INVALID_TEMPLATE error.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f9240c1f-0253-4408-b78b-11116eb280fe

📥 Commits

Reviewing files that changed from the base of the PR and between 1e667ae and 5c9bd95.

📒 Files selected for processing (2)

• apps/api/src/templates/blob-template-store.security.spec.ts
• apps/api/src/templates/blob-template-store.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

BlobTemplateStore.load now validates tenant IDs and environments before Azure Blob Storage access. Invalid values raise INVALID_TEMPLATE. Security tests cover empty, traversal, slash, hyphen, and dot-pattern tenant IDs, plus unsupported environments.

Changes

Tenant path validation

Layer / File(s)	Summary
Implement tenant and environment validation apps/api/src/templates/blob-template-store.ts	load validates tenant IDs against path-safe rules and environments against development, staging, and production before blob access.
Cover rejected identities and environments apps/api/src/templates/blob-template-store.security.spec.ts	Security tests verify INVALID_TEMPLATE errors and zero blob requests for invalid tenant IDs and environments.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 5c9bd

The change rejects unsafe tenant and environment values before blob access, with the supplied test plan reporting all API tests passing; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description includes the linked issue, summary, and basic test results. It omits the required Feedback focus and Automated checks sections, and its test plan does not provide the required setup, u…	Add the missing Feedback focus and Automated checks sections. Expand the Test plan with setup requirements, exact validation steps, and expected results for the normal and rejection paths.
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: validation of tenantId and environment in BlobTemplateStore.load.
Linked Issues check	✅ Passed	The changes satisfy issue #59 by validating tenantId and environment before blob path construction and storage access, returning INVALID_TEMPLATE for unsafe values, and updating security tests to veri…
Out of Scope Changes check	✅ Passed	The implementation and security test changes are directly related to issue #59 and the stated objectives. No unrelated changes are identified.

Full details: Description check

Explanation

The description includes the linked issue, summary, and basic test results. It omits the required Feedback focus and Automated checks sections, and its test plan does not provide the required setup, user-oriented steps, or expected results.

Full details: Linked Issues check

Explanation

The changes satisfy issue #59 by validating tenantId and environment before blob path construction and storage access, returning INVALID_TEMPLATE for unsafe values, and updating security tests to verify rejection and no blob calls.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/59-blob-path-validation

---

_{Comment @coderabbitai help to get the list of available commands.}