fix(lab): reject CL-04 invalid management read filters

[Wibias]

Summary

• Reject invalid excluded values on GET /api/lab/events instead of silently dropping the filter and returning an unfiltered result.
• Reject unsupported artifactClass values on GET /api/lab/artifacts instead of accepting arbitrary strings as an ArtifactClass.
• Add focused regression tests for both invalid-filter cases.

This is a focused follow-up to the CL-04 read surfaces from #1378. The broader post-merge review findings were re-checked against current dev; only these two issues remained real, unfixed, and worth changing.

Verification

• Compared agent/cl04-read-filter-validation against current dev: 2 commits, 2 changed files, branch is 0 commits behind dev at creation.
• Added tests/lab-read-filter-validation.test.ts covering both 400 responses and error codes.
• Local Bun execution was not available in this connector-only session, so the PR remains draft for repository CI validation.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. No docs change is needed because this corrects invalid-input handling rather than changing supported API behavior.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. No auth, credential, secret, or persistence boundary changes.

Summary by CodeRabbit

• Bug Fixes

  • Management API event filters now reject invalid exclusion values with a clear error response.
  • Artifact queries now validate artifact classes and return an error for unsupported values.

• Tests

  • Added coverage for invalid event exclusion filters and unsupported artifact classes.

[coderabbitai]

📝 Walkthrough

Walkthrough

The management API now rejects invalid excluded and artifactClass query values with HTTP 400 responses and specific error codes. Tests cover both validation cases.

Changes

Management API read-filter validation

Layer / File(s)	Summary
Route query validation src/server/management/lab-routes.ts	The events route rejects non-boolean excluded values with invalid_excluded at lines 327–330. The artifacts route rejects unsupported artifactClass values with invalid_artifact_class at lines 372–379.
Validation test coverage tests/lab-read-filter-validation.test.ts	Tests authenticate GET requests and verify HTTP 400 responses for invalid excluded and artifactClass values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to 118c9

GET /api/lab/artifacts still accepts an empty or whitespace-only artifactClass and returns an unfiltered result instead of a 400 response, so the PR is not merge-ready until this invalid-input case is handled.

Possibly related PRs

• lidge-jun/opencodex#1378: Extends the same handleLabRoutes implementation with stricter query validation and focused endpoint tests.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes rejecting invalid lab management read filters, which matches the main code and test changes.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/cl04-read-filter-validation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.