feat(search): Add comprehensive validation and sanitization for searc…

backend/src/analytics/analytics.controller.spec.ts

@@ -188,8 +188,8 @@ describe('AnalyticsController', () => {
       expect(result).toEqual(mockMarketHistory);
       expect(marketId).toBe('market-123');
       expect(interval).toBeUndefined();
-      expect((to as Date).getTime()).toBeGreaterThanOrEqual(before);
-      expect((to as Date).getTime() - (from as Date).getTime()).toBeCloseTo(
+      expect(to.getTime()).toBeGreaterThanOrEqual(before);
+      expect(to.getTime() - from.getTime()).toBeCloseTo(
         30 * 24 * 60 * 60 * 1000,
         -3,
       );
@@ -226,7 +226,7 @@ describe('AnalyticsController', () => {
       const [, from, to] = service.getMarketHistory.mock.calls.at(-1)!;
 
       expect(result).toEqual(historyWithDefaults);
-      expect((to as Date).getTime() - (from as Date).getTime()).toBeCloseTo(
+      expect(to.getTime() - from.getTime()).toBeCloseTo(
         30 * 24 * 60 * 60 * 1000,
         -3,
       );

backend/src/analytics/analytics.service.spec.ts

@@ -307,14 +307,12 @@ describe('AnalyticsService', () => {
         participant_count: 5,
         outcome_probabilities: [60, 40],
       });
-      expect(qb.andWhere).toHaveBeenCalledWith(
-        'history.recorded_at >= :from',
-        { from },
-      );
-      expect(qb.andWhere).toHaveBeenCalledWith(
-        'history.recorded_at <= :to',
-        { to },
-      );
+      expect(qb.andWhere).toHaveBeenCalledWith('history.recorded_at >= :from', {
+        from,
+      });
+      expect(qb.andWhere).toHaveBeenCalledWith('history.recorded_at <= :to', {
+        to,
+      });
     });
 
     it('should throw NotFoundException for invalid market', async () => {
@@ -327,9 +325,7 @@ describe('AnalyticsService', () => {
           new Date('2026-05-01T00:00:00.000Z'),
           new Date('2026-06-01T00:00:00.000Z'),
         ),
-      ).rejects.toThrow(
-        'Market "invalid" not found',
-      );
+      ).rejects.toThrow('Market "invalid" not found');
     });
   });
 

backend/src/common/dto/date-range-query.dto.spec.ts

@@ -37,9 +37,10 @@ describe('DateRangeQueryDto', () => {
     expect(from.toISOString()).toBe(
       new Date('2026-05-16T12:00:00.000Z').toISOString(),
     );
-    expect(
-      (to.getTime() - from.getTime()) / (24 * 60 * 60 * 1000),
-    ).toBeCloseTo(DEFAULT_DATE_RANGE_DAYS, 5);
+    expect((to.getTime() - from.getTime()) / (24 * 60 * 60 * 1000)).toBeCloseTo(
+      DEFAULT_DATE_RANGE_DAYS,
+      5,
+    );
   });
 
   it('accepts a valid explicit range', async () => {

backend/src/common/dto/date-range-query.dto.ts

@@ -29,9 +29,7 @@ function parseIsoDate(value: string): Date | undefined {
 }
 
 @ValidatorConstraint({ name: 'ValidAnalyticsDateRange', async: false })
-export class ValidAnalyticsDateRangeConstraint
-  implements ValidatorConstraintInterface
-{
+export class ValidAnalyticsDateRangeConstraint implements ValidatorConstraintInterface {
   private message = 'Invalid date range';
 
   validate(_value: unknown, args: ValidationArguments): boolean {

backend/src/common/interceptors/response.interceptor.spec.ts

@@ -1,6 +1,9 @@
 import { Test, TestingModule } from '@nestjs/testing';
 import { ExecutionContext, StreamableFile } from '@nestjs/common';
-import { ResponseInterceptor, ApiSuccessEnvelope } from './response.interceptor';
+import {
+  ResponseInterceptor,
+  ApiSuccessEnvelope,
+} from './response.interceptor';
 import { CallHandler } from '@nestjs/common';
 import { of } from 'rxjs';
 

backend/src/markets/dto/market-response.dto.ts

@@ -45,11 +45,9 @@ export class MarketResponseDto {
   @Expose()
   is_paused: boolean;
 
-
   @Expose()
   total_pool_stroops: string;
 
-
   @Expose()
   participant_count: number;
 

backend/src/markets/entities/market.entity.ts

@@ -83,7 +83,6 @@ export class Market {
   @IsBoolean()
   is_paused: boolean;
 
-
   @Column({ type: 'timestamptz', nullable: true })
   @IsOptional()
   featured_at: Date | null;

backend/src/markets/markets.controller.ts

@@ -219,7 +219,6 @@ export class MarketsController {
   @Delete(':id')
   @ApiBearerAuth()
   @ApiOperation({ summary: 'Cancel a prediction market (creator or admin)' })
-
   @ApiResponse({ status: 200, description: 'Market cancelled', type: Market })
   @ApiResponse({
     status: 400,
@@ -265,8 +264,6 @@ export class MarketsController {
     return this.marketsService.resumeMarket(id, user);
   }
 
-
-
   @Post(':id/comments')
   @UseGuards(BanGuard)
   @HttpCode(HttpStatus.CREATED)

backend/src/markets/markets.service.bulk.spec.ts

@@ -15,7 +15,6 @@ import { Prediction } from '../predictions/entities/prediction.entity';
 import { WebhookDispatcherService } from '../webhooks/services/webhook-dispatcher.service';
 import { CACHE_MANAGER } from '@nestjs/cache-manager';
 
-
 describe('MarketsService - Bulk Creation', () => {
   let service: MarketsService;
   let marketsRepository: jest.Mocked<Repository<Market>>;

backend/src/markets/markets.service.spec.ts

@@ -397,7 +397,6 @@ describe('MarketsService.findFeaturedMarkets', () => {
     reset: jest.fn(),
   };
 
-
   const makeFeaturedMarket = (overrides: Partial<Market> = {}): Market =>
     ({
       id: `market-${Math.random()}`,

backend/src/markets/markets.service.ts

@@ -547,8 +547,6 @@ export class MarketsService {
   async cancelMarket(id: string, user: User): Promise<Market> {
     const market = await this.findByIdOrOnChainId(id);
 
-
-
     const isAdmin = user.role === 'admin';
     const isCreator = market.creator.id === user.id;
     if (!isAdmin && !isCreator) {
@@ -803,7 +801,6 @@ export class MarketsService {
   async resumeMarket(id: string, user: User): Promise<Market> {
     const market = await this.findByIdOrOnChainId(id);
 
-
     if (user.role !== 'admin') {
       throw new ForbiddenException('Only admin can resume markets');
     }
@@ -822,7 +819,9 @@ export class MarketsService {
 
     // Optional: don't allow resuming after end_time has passed
     if (new Date() > market.end_time) {
-      throw new BadRequestException('Cannot resume market after end_time has passed');
+      throw new BadRequestException(
+        'Cannot resume market after end_time has passed',
+      );
     }
 
     try {
@@ -839,9 +838,7 @@ export class MarketsService {
   async removeBookmark(marketId: string, user: User): Promise<void> {
     const market = await this.findByIdOrOnChainId(marketId);
 
-
     await this.userBookmarksRepository.delete({
-
       user: { id: user.id },
       market: { id: market.id },
     });

backend/src/oracle/oracle.service.spec.ts

@@ -10,7 +10,6 @@ type MockRepo = jest.Mocked<
   Pick<Repository<any>, 'findOne' | 'createQueryBuilder' | 'find' | 'findByIds'>
 >;
 
-
 function createMockQueryBuilder<T>(
   returnValue: any,
 ): Partial<SelectQueryBuilder<T>> {
@@ -328,8 +327,12 @@ describe('OracleService', () => {
       const zeroQb = makeCountQb(0);
       matchRepo.createQueryBuilder
         .mockReturnValueOnce(zeroQb as unknown as SelectQueryBuilder<any>)
-        .mockReturnValueOnce(makeCountQb(0) as unknown as SelectQueryBuilder<any>)
-        .mockReturnValueOnce(makeCountQb(0) as unknown as SelectQueryBuilder<any>);
+        .mockReturnValueOnce(
+          makeCountQb(0) as unknown as SelectQueryBuilder<any>,
+        )
+        .mockReturnValueOnce(
+          makeCountQb(0) as unknown as SelectQueryBuilder<any>,
+        );
 
       const result = await service.getStats();
 

backend/src/predictions/predictions.service.ts

@@ -68,7 +68,6 @@ export class PredictionsService {
       );
     }
 
-
     if (!market.outcome_options.includes(dto.chosen_outcome)) {
       throw new BadRequestException(
         `Invalid outcome "${dto.chosen_outcome}". Valid options: ${market.outcome_options.join(', ')}`,