From 72da224033ed1c9fc9fa3156bf97aea9579a45b3 Mon Sep 17 00:00:00 2001 From: Sergey Kozyrenko Date: Fri, 10 Jul 2026 16:01:36 +0700 Subject: [PATCH] feat(prompts): validate template syntax on the REST update endpoint The GraphQL createPrompt/updatePrompt mutations run validator.ValidatePrompt (Go text/template parse + declared-variable check + trial render), but the REST PUT /prompts/:type handler only checked the field was present, so a prompt with a syntax error or an undeclared variable could be stored over REST and later break rendering. Mirror the GraphQL check in PatchPrompt. Co-Authored-By: Claude Opus 4.8 --- backend/pkg/server/services/prompts.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/backend/pkg/server/services/prompts.go b/backend/pkg/server/services/prompts.go index c3d0db39..174a2493 100644 --- a/backend/pkg/server/services/prompts.go +++ b/backend/pkg/server/services/prompts.go @@ -10,6 +10,7 @@ import ( "pentagi/pkg/server/rdb" "pentagi/pkg/server/response" "pentagi/pkg/templates" + "pentagi/pkg/templates/validator" "github.com/gin-gonic/gin" "github.com/jinzhu/gorm" @@ -208,6 +209,10 @@ func (s *PromptService) PatchPrompt(c *gin.Context) { logger.FromContext(c).WithError(err).Errorf("error validating prompt type '%s'", promptType) response.Error(c, response.ErrPromptsInvalidRequest, err) return + } else if err = validator.ValidatePrompt(templates.PromptType(promptType), prompt.Prompt); err != nil { + logger.FromContext(c).WithError(err).Errorf("error validating prompt template '%s'", promptType) + response.Error(c, response.ErrPromptsInvalidRequest, err) + return } privs := c.GetStringSlice("prm")