From 9e90d04ef5f92aef8ada7b710658fd6227f481a5 Mon Sep 17 00:00:00 2001
From: ht <hikmet@texmart.com>
Date: Sun, 6 Sep 2026 17:37:16 +0300
Subject: [PATCH] validate persisted AI job JSON

---
 server/ai-job-store.mjs | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/server/ai-job-store.mjs b/server/ai-job-store.mjs
index 0699021..d3539a6 100644
--- a/server/ai-job-store.mjs
+++ b/server/ai-job-store.mjs
@@ -5,6 +5,10 @@ import {fileURLToPath} from 'node:url';
 import {randomUUID,createHash} from 'node:crypto';
 const root=process.env.IHALEIST_USER_DATA_DIR || join(dirname(fileURLToPath(import.meta.url)),'data');
 const operations=new Set(['analiz','belge-sor','teklif-denetim','teklif-taslak']);
+function parseObjectJson(raw,label) {
+ try { const value=JSON.parse(raw); if(!value || typeof value!=='object' || Array.isArray(value))throw new Error('nesne değil'); return value; }
+ catch { throw new Error(`${label} verisi bozuk; AI işi durduruldu.`); }
+}
 function dbWork(fn) {
  mkdirSync(root,{recursive:true,mode:0o700});const db=new DatabaseSync(join(root,'ai-jobs.sqlite'));chmodSync(join(root,'ai-jobs.sqlite'),0o600);
  try {
@@ -26,7 +30,7 @@ function dbWork(fn) {
 function publicJob(row) {
  if(!row)return null;
  return {id:row.id,operation:row.operation,ikn:row.ikn,state:row.state,createdAt:row.created_at,updatedAt:row.updated_at,
-  result:row.result?JSON.parse(row.result):null,error:row.error,inputHash:row.input_hash};
+  result:row.result?parseObjectJson(row.result,'AI sonucu'):null,error:row.error,inputHash:row.input_hash};
 }
 export function createAiJob(email,requestId,operation,input) {
  if(typeof requestId!=='string'||requestId.length<8||requestId.length>100||!operations.has(operation)||!input||typeof input!=='object'||Array.isArray(input))throw new Error('Geçersiz AI işi.');
@@ -45,7 +49,7 @@ export function createAiJob(email,requestId,operation,input) {
   } catch(error){db.exec('ROLLBACK');throw error;}
  });
 }
-export const getAiJob=(email,id)=>dbWork(db=>{const row=db.prepare('SELECT * FROM ai_jobs WHERE email=? AND id=?').get(email,id);return row?{...publicJob(row),input:JSON.parse(row.resolved_input || row.input)}:null;});
+export const getAiJob=(email,id)=>dbWork(db=>{const row=db.prepare('SELECT * FROM ai_jobs WHERE email=? AND id=?').get(email,id);return row?{...publicJob(row),input:parseObjectJson(row.resolved_input || row.input,'AI girdisi')}:null;});
 export const listAiJobs=(email,ikn)=>dbWork(db=>db.prepare('SELECT * FROM ai_jobs WHERE email=? AND (? IS NULL OR ikn=?) ORDER BY created_at DESC LIMIT 50').all(email,ikn||null,ikn||null).map(publicJob));
 export function claimAiJob(clock=Date.now()) {
  return dbWork(db=>{
@@ -58,7 +62,8 @@ export function claimAiJob(clock=Date.now()) {
    if(!row){db.exec('COMMIT');return null;}
    const runId=randomUUID();
    db.prepare("UPDATE ai_jobs SET state='running',run_id=?,heartbeat=?,updated_at=? WHERE id=?").run(runId,clock,new Date(clock).toISOString(),row.id);
-   db.exec('COMMIT');return {id:row.id,email:row.email,operation:row.operation,input:JSON.parse(row.resolved_input || row.input),sourcePinned:row.resolved_input!==null,runId};
+   const input=parseObjectJson(row.resolved_input || row.input,'AI girdisi');
+   db.exec('COMMIT');return {id:row.id,email:row.email,operation:row.operation,input,sourcePinned:row.resolved_input!==null,runId};
   }catch(error){db.exec('ROLLBACK');throw error;}
  });
 }