From a08c40fe4e999eeb16644abf782defd5388d8af9 Mon Sep 17 00:00:00 2001
From: daily-backlog-pr <automation@openintercom.local>
Date: Thu, 17 Sep 2026 12:40:54 +0000
Subject: [PATCH] fix(security): enforce TypeBox body schema on PATCH
 /session/:sessionId

The PATCH /session/:sessionId handler declared Body: SdpAnswer in its
generic but omitted body from the Fastify schema object, so AJV skipped
request-body validation entirely. Add body: SdpAnswer so malformed or
oversized SDP answer payloads are rejected before reaching SDP handling.

Closes #248
---
 src/api_productions.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/api_productions.ts b/src/api_productions.ts
index e12c312..da0f5db 100644
--- a/src/api_productions.ts
+++ b/src/api_productions.ts
@@ -753,6 +753,7 @@ const apiProductions: FastifyPluginCallback<ApiProductionsOptions> = (
         description:
           'Provide client local SDP description as request body to finalize connection protocol.',
         params: SessionIdParams,
+        body: SdpAnswer,
         response: {
           204: Type.Null(),
           400: Type.String(),