Merge pull request #8 from akhilnarang/fix-validation

fix(user_profile): validate fields received by the API

Author: sokumon

eps/eps/doctype/energy_point_log/energy_point_log.py

@@ -394,4 +394,4 @@ def get_footer_message(timespan):
 
 
 def delete_energy_point_logs_for_user(user, event):
-    frappe.db.delete("Energy Point Log", {"user": user.name})
+	frappe.db.delete("Energy Point Log", {"user": user.name})

eps/eps/page/user_profile/user_profile.py

@@ -7,7 +7,7 @@
 
 
 @frappe.whitelist()
-def get_energy_points_heatmap_data(user, date):
+def get_energy_points_heatmap_data(user: str, date: str | None):
 	try:
 		date = getdate(date)
 	except Exception:
@@ -29,7 +29,10 @@ def get_energy_points_heatmap_data(user, date):
 
 
 @frappe.whitelist()
-def get_energy_points_percentage_chart_data(user, field):
+def get_energy_points_percentage_chart_data(user: str, field: str):
+	if field not in ("type", "reference_doctype", "rule"):
+		frappe.throw(frappe._("Invalid field for grouping"))
+
 	result = frappe.get_all(
 		"Energy Point Log",
 		filters={"user": user, "type": ["!=", "Review"]},
@@ -46,7 +49,7 @@ def get_energy_points_percentage_chart_data(user, field):
 
 
 @frappe.whitelist()
-def get_user_rank(user):
+def get_user_rank(user: str):
 	month_start = datetime.today().replace(day=1)
 	monthly_rank = frappe.get_all(
 		"Energy Point Log",
@@ -88,7 +91,7 @@ def update_profile_info(profile_info):
 
 
 @frappe.whitelist()
-def get_energy_points_list(start, limit, user):
+def get_energy_points_list(start: int, limit: int, user: str):
 	return frappe.db.get_list(
 		"Energy Point Log",
 		filters={"user": user, "type": ["!=", "Review"]},