Merge pull request 'Assert partner and member route params in finance handlers.' (#40) from dev into main

Reviewed-on: #40

backend/src/routes/eventFinance.ts

@@ -340,7 +340,7 @@ financeRouter.put('/:id/expenses/:expenseId', requireEventPermission(EXPENSE_EDI
 });
 
 financeRouter.delete('/:id/expenses/:expenseId', requireEventPermission(EXPENSE_EDITORS), async (c) => {
-  const eventId = c.req.param('id');
+  const eventId = c.req.param('id')!;
   const closed = await assertOpen(c, eventId);
   if (closed) return closed;
   const existing = await dbGet<any>(
@@ -468,7 +468,7 @@ financeRouter.put('/:id/other-income/:incomeId', requireEventPermission('edit_ex
 });
 
 financeRouter.delete('/:id/other-income/:incomeId', requireEventPermission('edit_expenses'), async (c) => {
-  const eventId = c.req.param('id');
+  const eventId = c.req.param('id')!;
   const closed = await assertOpen(c, eventId);
   if (closed) return closed;
   const existing = await dbGet<any>(
@@ -594,10 +594,10 @@ financeRouter.put('/:id/partners/:partnerId', requireEventPermission('edit_expen
 
 financeRouter.delete('/:id/partners/:partnerId', requireEventPermission('edit_expenses'), async (c) => {
   if (!canManageSplit(c)) return splitForbidden(c);
-  const eventId = c.req.param('id');
+  const eventId = c.req.param('id')!;
   const closed = await assertOpen(c, eventId);
   if (closed) return closed;
-  const existing = await loadPartner(eventId, c.req.param('partnerId'));
+  const existing = await loadPartner(eventId, c.req.param('partnerId')!);
   if (!existing) return c.json({ error: 'Partner not found' }, 404);
   const fronted = await dbGet<any>(
     (db as any).select({ id: (eventExpenses as any).id }).from(eventExpenses).where(eq((eventExpenses as any).paidByPartnerId, existing.id))
@@ -732,7 +732,7 @@ financeRouter.post('/:id/finance/unfinalize', requireEventPermission('view_finan
   if (!canUnfinalize(access)) {
     return c.json({ error: 'Only admins and co-managers can unfinalize', code: 'EVENT_PERMISSION' }, 403);
   }
-  const eventId = c.req.param('id');
+  const eventId = c.req.param('id')!;
   const state = await getFinanceState(eventId);
   if (state.status === 'open') return c.json({ error: 'Not finalized' }, 409);
   const user = currentUser(c);
@@ -921,8 +921,8 @@ financeRouter.put('/:id/members/:memberId', requireEventPermission('manage_team'
 });
 
 financeRouter.delete('/:id/members/:memberId', requireEventPermission('manage_team'), async (c) => {
-  const eventId = c.req.param('id');
+  const eventId = c.req.param('id')!;
-  const existing = await loadMember(eventId, c.req.param('memberId'));
+  const existing = await loadMember(eventId, c.req.param('memberId')!);
   if (!existing) return c.json({ error: 'Member not found' }, 404);
   const user = currentUser(c);
   const target = await loadUser(existing.userId);

backend/src/routes/finance.ts

@@ -83,7 +83,7 @@ financeGlobalRouter.put('/settings/expense-categories/:id', ADMIN, zValidator('j
 });
 
 financeGlobalRouter.delete('/settings/expense-categories/:id', ADMIN, async (c) => {
-  const id = c.req.param('id');
+  const id = c.req.param('id')!;
   const existing = await dbGet<any>((db as any).select().from(expenseCategories).where(eq((expenseCategories as any).id, id)));
   if (!existing) return c.json({ error: 'Category not found' }, 404);
   const [usedByExpense, usedByTemplate] = await Promise.all([
@@ -161,7 +161,7 @@ financeGlobalRouter.put('/settings/expense-templates/:id', ADMIN, zValidator('js
 });
 
 financeGlobalRouter.delete('/settings/expense-templates/:id', ADMIN, async (c) => {
-  const id = c.req.param('id');
+  const id = c.req.param('id')!;
   const existing = await dbGet<any>((db as any).select().from(expenseTemplates).where(eq((expenseTemplates as any).id, id)));
   if (!existing) return c.json({ error: 'Template not found' }, 404);
   const [usedByExpense, usedByPack] = await Promise.all([
@@ -250,7 +250,7 @@ financeGlobalRouter.put('/settings/expense-template-packs/:id', ADMIN, zValidato
 });
 
 financeGlobalRouter.delete('/settings/expense-template-packs/:id', ADMIN, async (c) => {
-  const id = c.req.param('id');
+  const id = c.req.param('id')!;
   const before = (await loadPacks()).find((p) => p.id === id);
   if (!before) return c.json({ error: 'Pack not found' }, 404);
   await runOps([