From 25c92761f7df7edf2bc32963d050e2530391af37 Mon Sep 17 00:00:00 2001
From: Dariusz L <dl122@wp.pl>
Date: Thu, 6 Aug 2026 16:23:21 +0200
Subject: [PATCH] refactor: share progress parameter validation

---
 core/routes/helpers.py      |  8 ++++++--
 tests/test_route_helpers.py | 21 +++++++++++++++++++++
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/core/routes/helpers.py b/core/routes/helpers.py
index 5fc9973..cd7ec04 100644
--- a/core/routes/helpers.py
+++ b/core/routes/helpers.py
@@ -64,6 +64,10 @@ def create_route_helpers(web, logger, load_settings, hash_calculation_cancelled)
 
         return decorator
 
+    def _get_required_match_param(request, param_name):
+        value = request.match_info.get(param_name, "").strip()
+        return value or None
+
     def get_progress_response(
         tracker,
         request,
@@ -72,7 +76,7 @@ def create_route_helpers(web, logger, load_settings, hash_calculation_cancelled)
         not_found_status=200,
         found_wrapper=None,
     ):
-        job_id = request.match_info.get(param_name, "").strip()
+        job_id = _get_required_match_param(request, param_name)
         if not job_id:
             return web.json_response(
                 {"error": f"{param_name} is required"},
@@ -93,7 +97,7 @@ def create_route_helpers(web, logger, load_settings, hash_calculation_cancelled)
         param_name="progress_id",
         cancel_message="Cancelled",
     ):
-        job_id = request.match_info.get(param_name, "").strip()
+        job_id = _get_required_match_param(request, param_name)
         if not job_id:
             return web.json_response(
                 {"error": f"{param_name} is required"},
diff --git a/tests/test_route_helpers.py b/tests/test_route_helpers.py
index 667fafb..84b1f05 100644
--- a/tests/test_route_helpers.py
+++ b/tests/test_route_helpers.py
@@ -170,6 +170,27 @@ def test_progress_helpers_validate_ids_and_wrap_results():
     tracker.mark_cancelled.assert_called_once_with("job-1", "Cancelled")
 
 
+@pytest.mark.parametrize("helper_index", [1, 2])
+def test_progress_helpers_reject_blank_ids(helper_index):
+    (
+        _,
+        get_progress_response,
+        cancel_progress_response,
+        *_rest,
+    ), _ = _build_helpers()
+    tracker = MagicMock()
+    request = SimpleNamespace(match_info={"analysis_id": "   "})
+    helper = (get_progress_response, cancel_progress_response)[helper_index - 1]
+
+    response = helper(tracker, request, param_name="analysis_id")
+
+    assert response.status == 400
+    assert response.text == '{"error": "analysis_id is required"}'
+    tracker.cleanup.assert_not_called()
+    tracker.get.assert_not_called()
+    tracker.mark_cancelled.assert_not_called()
+
+
 def test_background_helper_reports_unexpected_task_errors():
     (_, _, _, run_in_background_thread, *_rest), logger = _build_helpers()
     tracker = MagicMock()