validate screen names in feedbag endpoint

server/http/mgmt_api.go

@@ -1320,7 +1320,18 @@ func putFeedbagBuddyHandler(w http.ResponseWriter, r *http.Request, buddyBroadca
 		return
 	}
 
-	newBuddy := state.NewIdentScreenName(buddyScreenName)
+	newBuddy := state.DisplayScreenName(buddyScreenName)
+	if newBuddy.IsUIN() {
+		if err := newBuddy.ValidateUIN(); err != nil {
+			errorMsg(w, fmt.Sprintf("invalid uin: %s", err), http.StatusBadRequest)
+			return
+		}
+	} else {
+		if err := newBuddy.ValidateAIMHandle(); err != nil {
+			errorMsg(w, fmt.Sprintf("invalid screen name: %s", err), http.StatusBadRequest)
+			return
+		}
+	}
 
 	items, err := feedbagManager.Feedbag(r.Context(), me)
 	if err != nil {
@@ -1335,7 +1346,7 @@ func putFeedbagBuddyHandler(w http.ResponseWriter, r *http.Request, buddyBroadca
 		switch {
 		case item.ClassID == wire.FeedbagClassIdGroup && item.GroupID == groupID:
 			group = &item
-		case item.ClassID == wire.FeedbagClassIdBuddy && item.GroupID == groupID && item.Name == newBuddy.String():
+		case item.ClassID == wire.FeedbagClassIdBuddy && item.GroupID == groupID && item.Name == newBuddy.IdentScreenName().String():
 			response := struct {
 				Name    string `json:"name"`
 				GroupID uint16 `json:"group_id"`
@@ -1416,7 +1427,7 @@ func putFeedbagBuddyHandler(w http.ResponseWriter, r *http.Request, buddyBroadca
 		})
 		instances := session.Instances()
 		if len(instances) > 0 {
-			if err := buddyBroadcaster.BroadcastVisibility(r.Context(), instances[0], []state.IdentScreenName{newBuddy}, false); err != nil {
+			if err := buddyBroadcaster.BroadcastVisibility(r.Context(), instances[0], []state.IdentScreenName{newBuddy.IdentScreenName()}, false); err != nil {
 				logger.Error("error broadcasting visibility", "err", err.Error())
 			}
 		}

server/http/mgmt_api_test.go

@@ -3438,9 +3438,9 @@ func TestFeedbagBuddyHandler_PUT(t *testing.T) {
 			name:           "add a buddy that already exists in a group",
 			screenName:     "userA",
 			groupID:        "1",
-			requestBody:    `{"name":"existingbuddy"}`,
+			requestBody:    `{"name":"ExistingBuddy"}`,
 			wantStatusCode: http.StatusOK,
-			wantResponse:   `{"name":"existingbuddy","group_id":1,"item_id":12345}`,
+			wantResponse:   `{"name":"ExistingBuddy","group_id":1,"item_id":12345}`,
 			mockParams: mockParams{
 				feedbagManagerParams: feedbagManagerParams{
 					feedbagParams: feedbagParams{
@@ -3649,6 +3649,38 @@ func TestFeedbagBuddyHandler_PUT(t *testing.T) {
 			wantStatusCode: http.StatusBadRequest,
 			wantResponse:   `{"message":"buddy_screen_name is required"}`,
 		},
+		{
+			name:           "invalid UIN - too low",
+			screenName:     "userA",
+			groupID:        "1",
+			requestBody:    `{"name":"9999"}`,
+			wantStatusCode: http.StatusBadRequest,
+			wantResponse:   `{"message":"invalid uin: uin must be a number in the range 10000-2147483646"}`,
+		},
+		{
+			name:           "invalid UIN - too high",
+			screenName:     "userA",
+			groupID:        "1",
+			requestBody:    `{"name":"2147483647"}`,
+			wantStatusCode: http.StatusBadRequest,
+			wantResponse:   `{"message":"invalid uin: uin must be a number in the range 10000-2147483646"}`,
+		},
+		{
+			name:           "invalid AIM handle - too short",
+			screenName:     "userA",
+			groupID:        "1",
+			requestBody:    `{"name":"Us"}`,
+			wantStatusCode: http.StatusBadRequest,
+			wantResponse:   `{"message":"invalid screen name: screen name must be between 3 and 16 characters"}`,
+		},
+		{
+			name:           "invalid AIM handle - too long",
+			screenName:     "userA",
+			groupID:        "1",
+			requestBody:    `{"name":"ThisIsAReallyLongScreenName"}`,
+			wantStatusCode: http.StatusBadRequest,
+			wantResponse:   `{"message":"invalid screen name: screen name must be between 3 and 16 characters"}`,
+		},
 		{
 			name:           "error retrieving feedbag",
 			screenName:     "userA",