Security: PATCH /session response schema declares 200 but handler sends 204 — validation bypass

[LucasMaupin]

Summary

The PATCH /session/:sessionId route handler calls reply.code(204).send() on success, but the TypeBox response schema only declares 200: Type.String(). This mismatch means Fastify applies the wrong serializer and the 204 response bypasses schema validation.

Location

• src/api_productions.ts — PATCH /session/:sessionId route (schema ~line 754, handler response ~line 827)

Details

Fastify validates and serializes responses according to declared status code schemas. When the actual response code (204) is not declared in the schema, Fastify cannot validate the response. While not directly exploitable today, this undermines the type-safety guarantees of Fastify's schema-driven approach and could mask future security regressions where sensitive data is accidentally included in a response.

Note: Related issue #248 covers the missing body: field in this same route. This 204/200 mismatch is a separate gap.

Recommendation

Add 204: Type.Null() to the response schema and remove the incorrect 200: Type.String() entry:

response: {
  204: Type.Null(),
  400: Type.String(),
  500: Type.String(),
}

Severity

LOW