Add null checks in feedback processing pipeline (FRE-4514)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/api/src/services/spamshield/spamshield.service.ts

@@ -366,8 +366,27 @@ export class SpamFeedbackService {
     confidence?: number,
     metadata?: Record<string, any>
   ): Promise<SpamFeedback> {
-    // Validate metadata
-    const validation = this.validateMetadata(metadata);
+    // Defensive null checks for required fields
+    if (!userId || typeof userId !== 'string' || userId.trim().length === 0) {
+      throw new Error('Feedback: userId is required');
+    }
+
+    if (!phoneNumber || typeof phoneNumber !== 'string' || phoneNumber.trim().length === 0) {
+      throw new Error('Feedback: phoneNumber is required');
+    }
+
+    if (typeof isSpam !== 'boolean') {
+      throw new Error('Feedback: isSpam must be a boolean');
+    }
+
+    // Validate confidence range if provided
+    const validatedConfidence = confidence !== undefined && confidence !== null
+      ? (Number.isFinite(confidence) && confidence >= 0 && confidence <= 1 ? confidence : undefined)
+      : undefined;
+
+    // Treat null metadata as undefined
+    const effectiveMetadata = metadata !== null ? metadata : undefined;
+    const validation = this.validateMetadata(effectiveMetadata);
     const validatedMetadata = validation.trimmedMetadata;
 
     // Only enable if feature flag is set
@@ -379,7 +398,7 @@ export class SpamFeedbackService {
         phoneNumber,
         phoneNumberHash: this.hashPhoneNumber(phoneNumber),
         isSpam,
-        confidence,
+        confidence: validatedConfidence,
         feedbackType: 'user_confirmation' as const,
         metadata: validatedMetadata,
         createdAt: new Date(),
@@ -395,7 +414,7 @@ export class SpamFeedbackService {
         phoneNumber,
         phoneNumberHash,
         isSpam,
-        confidence,
+        confidence: validatedConfidence,
         feedbackType: 'user_confirmation',
         metadata: validatedMetadata,
       },

packages/integration-tests/package.json

@@ -16,6 +16,7 @@
     "@shieldai/shared-notifications": "workspace:*",
     "jest": "^29.7.0",
     "@types/jest": "^29.5.0",
+    "@jest/globals": "^29.7.0",
     "ts-jest": "^29.1.0",
     "typescript": "^5.0.0"
   },