Merge pull request #488 from Obiajulu-gif/work-order-status-validation

Work order status validation

Author: floxxih

backend/app/routes/orders.py

@@ -16,6 +16,21 @@
 router = APIRouter()
 matching_service = OrderMatchingService()
 
+ALLOWED_ORDER_STATUSES = {"open", "matched", "filled", "cancelled", "expired"}
+
+
+def validate_order_status_filter(status: Optional[str]) -> Optional[str]:
+    if status is None:
+        return None
+    normalized = status.lower()
+    if normalized not in ALLOWED_ORDER_STATUSES:
+        allowed = ", ".join(sorted(ALLOWED_ORDER_STATUSES))
+        raise HTTPException(
+            status_code=400,
+            detail=f"Invalid order status '{status}'. Allowed values: {allowed}",
+        )
+    return normalized
+
 
 @router.post("/", response_model=OrderResponse, status_code=201)
 async def create_order(
@@ -63,6 +78,7 @@ async def list_orders(
     offset: Annotated[int, Query(ge=0)] = 0,
     db: AsyncSession = Depends(get_db),
 ):
+    status = validate_order_status_filter(status)
     cache_key = f"orders:{from_chain}:{to_chain}:{status}:{limit}:{offset}"
     cache = CacheService(get_redis())
     cached = await cache.get(cache_key)

backend/tests/test_order_status_filters.py

@@ -0,0 +1,21 @@
+import pytest
+from fastapi import HTTPException
+
+from app.routes.orders import validate_order_status_filter
+
+
+def test_valid_order_status_filter_is_normalized():
+    assert validate_order_status_filter("OPEN") == "open"
+
+
+def test_missing_order_status_filter_is_allowed():
+    assert validate_order_status_filter(None) is None
+
+
+def test_invalid_order_status_filter_returns_clear_client_error():
+    with pytest.raises(HTTPException) as exc:
+        validate_order_status_filter("unknown")
+
+    assert exc.value.status_code == 400
+    assert "Invalid order status 'unknown'" in exc.value.detail
+    assert "Allowed values" in exc.value.detail