From 2cf86a22de55b4962c96c6d6e24b4ccc5043db84 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9CNaeel=E2=80=9D?= <tazet@narod.ru>
Date: Mon, 15 Jun 2026 10:45:21 +0400
Subject: [PATCH] =?UTF-8?q?v0.6.11:=20guard=20=D0=BD=D0=B0=20=D0=92=D0=A1?=
 =?UTF-8?q?=D0=95=20=D0=BE=D0=B1=D1=8F=D0=B7=D0=B0=D1=82=D0=B5=D0=BB=D1=8C?=
 =?UTF-8?q?=D0=BD=D1=8B=D0=B5=20=D0=BF=D0=BE=D0=BB=D1=8F=20DB=20=E2=80=94?=
 =?UTF-8?q?=20companyId,=20cidr,=20userEmail,=20entryId?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 package.json           |  2 +-
 v2/src/config/index.js |  2 +-
 v2/src/db/queries.js   | 15 +++++++++++++++
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index b42b60e..236736e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ipwhitelist",
-  "version": "0.6.10",
+  "version": "0.6.11",
   "description": "IP WhiteList microservice for cloud provider",
   "main": "server.js",
   "scripts": {
diff --git a/v2/src/config/index.js b/v2/src/config/index.js
index 82fb505..a168d72 100644
--- a/v2/src/config/index.js
+++ b/v2/src/config/index.js
@@ -9,7 +9,7 @@
 // ═══════════════════════════════════════════════════════════════════════════════
 
 module.exports = {
-  version: '0.6.10',
+  version: '0.6.11',
 
   // ── IAM ──────────────────────────────────────────────────────────────────
   iamUrl: process.env.V2_IAM_URL || 'https://auth-api.ngcloud.ru/api/v1/auth/user',
diff --git a/v2/src/db/queries.js b/v2/src/db/queries.js
index 1fffcb5..2bbbd65 100644
--- a/v2/src/db/queries.js
+++ b/v2/src/db/queries.js
@@ -67,6 +67,9 @@ async function listEntries(companyId, includeDeleted = false) {
  * Создать запись (с валидацией, проверкой лимита и пересечений).
  */
 async function createEntry(companyId, cidr, comment, userEmail, impersonatedBy, wasNormalized = false) {
+  if (!companyId) throw new Error('DB: companyId обязателен');
+  if (!cidr) throw new Error('DB: cidr обязателен');
+  if (!userEmail) throw new Error('DB: userEmail обязателен');
   const client = await pool.connect();
   try {
     await client.query('BEGIN');
@@ -113,6 +116,10 @@ async function createEntry(companyId, cidr, comment, userEmail, impersonatedBy,
  * Обновить запись.
  */
 async function updateEntry(entryId, companyId, cidr, comment, userEmail, impersonatedBy, wasNormalized = false) {
+  if (!entryId) throw new Error('DB: entryId обязателен');
+  if (!companyId) throw new Error('DB: companyId обязателен');
+  if (!cidr) throw new Error('DB: cidr обязателен');
+  if (!userEmail) throw new Error('DB: userEmail обязателен');
   const client = await pool.connect();
   try {
     await client.query('BEGIN');
@@ -154,6 +161,9 @@ async function updateEntry(entryId, companyId, cidr, comment, userEmail, imperso
  * Удалить запись (soft delete).
  */
 async function deleteEntry(entryId, companyId, userEmail, impersonatedBy) {
+  if (!entryId) throw new Error('DB: entryId обязателен');
+  if (!companyId) throw new Error('DB: companyId обязателен');
+  if (!userEmail) throw new Error('DB: userEmail обязателен');
   const client = await pool.connect();
   try {
     await client.query('BEGIN');
@@ -197,6 +207,8 @@ async function getAllCompanies() {
 }
 
 async function setLimit(companyId, newLimit) {
+  if (!companyId) throw new Error('DB: companyId обязателен');
+  if (newLimit == null || newLimit < 0) throw new Error('DB: newLimit должен быть >= 0');
   const result = await pool.query(
     'UPDATE companies SET custom_limit = $1, updated_at = NOW() WHERE id = $2',
     [newLimit, companyId]
@@ -221,6 +233,9 @@ async function getExportCIDRs(companyId = null) {
 // ── Аудит ─────────────────────────────────────────────────────────────────────
 
 async function logAudit(userEmail, companyId, action, oldValue, newValue, entryId, impersonatedBy, db = pool) {
+  if (!userEmail) throw new Error('DB audit: userEmail обязателен');
+  if (!companyId) throw new Error('DB audit: companyId обязателен');
+  if (!action) throw new Error('DB audit: action обязателен');
   await db.query(
     `INSERT INTO audit_log (user_email, company_id, action, old_value, new_value, entry_id, impersonated_by)
      VALUES ($1, $2, $3, $4, $5, $6, $7)`,