[finallyjay]

Summary

Part of #74 (reported by the daily.dev team while reviewing the marketplace submission).

• DELETE /api/bookmarks/:id now rejects any id that isn't ^[\w-]+$ with 400 Invalid bookmark id, before anything is sent to daily.dev.
• deleteBookmark() also wraps the id in encodeURIComponent, so the client can't reach another endpoint even if a caller skips the route check.

Before, DELETE /api/bookmarks/lists%2F<id> reached DELETE /public/v1/bookmarks/lists/<id> (and ..%2F reached other resources) with the signed-in user's own token.

Test plan

• New tests/e2e/api-bookmarks.spec.ts: lists%2F…, ..%2Ffeeds%2F…, ? and . ids all get 400. Without the route check they were forwarded to daily.dev (502)
• pnpm lint, pnpm format:check, pnpm build, pnpm test (32 passed)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
daily-dev-roulette	Ready	Preview	Oct 9, 2026 12:08pm UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b288fc45-bad3-4009-8534-634f27c3e402

---

📥 Commits

Reviewing files that changed from the base of the PR and between 0e655d4 and 501e914.

---

📒 Files selected for processing (3)

• src/lib/daily.ts
• src/pages/api/bookmarks/[id].ts
• tests/e2e/api-bookmarks.spec.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📜 Recent review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: ci
• GitHub Check: Analyze (javascript-typescript)
• GitHub Check: Analyze (actions)

---

🔇 Additional comments (3)

src/pages/api/bookmarks/[id].ts (1)

13-15: LGTM!

---

src/lib/daily.ts (1)

132-133: LGTM!

---

tests/e2e/api-bookmarks.spec.ts (1)

7-18: LGTM!

---

---

---

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Bookmark deletion now safely encodes identifiers in requests, including those containing reserved URL characters.
  • Invalid bookmark identifiers are rejected with a clear error response instead of being passed through for deletion.

Walkthrough

The DELETE route now rejects missing bookmark IDs and IDs outside the allowed character pattern. The client URL-encodes IDs in DELETE paths. An end-to-end test checks 400 responses for invalid IDs.

Changes

Bookmark DELETE ID handling

Layer / File(s)	Summary
Validate and encode DELETE IDs src/pages/api/bookmarks/[id].ts, src/lib/daily.ts, tests/e2e/api-bookmarks.spec.ts	The route returns a 400 response with Invalid bookmark id when the ID is missing or fails the allowed-character check. The client URL-encodes the ID in the DELETE path. The end-to-end test checks invalid IDs and the response body.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

---

Merge Risk: ⚪ Minimal · up to 501e9

Malformed dot-segment IDs are rejected before the external deletion request. No material merge-blocking behavior is established, so the change appears ready for normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: restricting bookmark IDs for DELETE /api/bookmarks/:id.
Description check		The description directly explains the bookmark ID validation, URL encoding safeguard, security issue, tests, and verification results.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

---

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{A rabbit checks the path at night
Each slash is tucked away from sight
A missing name gets a clear reply
Four test requests hop neatly by
The DELETE route keeps IDs in line
Then nibbles carrots, safe and fine}

_{Comment @coderabbitai help to get the list of available commands.}