fix: strip client-provided timestamps in client response API (ENG-828)

The client-facing POST /api/v1/client and /api/v2/client response endpoints accepted arbitrary createdAt/updatedAt values, allowing any respondent to backdate or future-date their submission and poison time-series analytics. Strip both fields before the Prisma insert in the client code paths. The management API retains the ability to pass timestamps, as it is authenticated and used for legitimate server-side data imports. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-19 03:04:39 -05:00 · 2026-05-19 09:32:06 +02:00
2 changed files with 6 additions and 15 deletions
@@ -104,7 +104,11 @@ export const createResponse = async (

    const ttc = initialTtc ? (finished ? calculateTtcTotal(initialTtc) : initialTtc) : {};

-    const prismaData = buildPrismaResponseData(responseInput, contact, ttc);
+    const prismaData = buildPrismaResponseData(
+      { ...responseInput, createdAt: undefined, updatedAt: undefined },
+      contact,
+      ttc
+    );

    const prismaClient = tx ?? prisma;

@@ -49,18 +49,7 @@ const buildPrismaResponseData = (
  contact: { id: string; attributes: TContactAttributes } | null,
  ttc: Record<string, number>
 ): Prisma.ResponseCreateInput => {
-  const {
-    surveyId,
-    displayId,
-    finished,
-    data,
-    language,
-    meta,
-    singleUseId,
-    variables,
-    createdAt,
-    updatedAt,
-  } = responseInput;
+  const { surveyId, displayId, finished, data, language, meta, singleUseId, variables } = responseInput;

  return {
    survey: {
@@ -84,8 +73,6 @@ const buildPrismaResponseData = (
    singleUseId,
    ...(variables && { variables }),
    ttc: ttc,
-    createdAt,
-    updatedAt,
  };
 };