From e368b18bde7b6186a5d0feaa81012d235e72c3bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9CNaeel=E2=80=9D?= <tazet@narod.ru>
Date: Sun, 2 Aug 2026 06:23:08 +0400
Subject: [PATCH] =?UTF-8?q?v0.5.4:=20fix=20500=20=D0=BD=D0=B0=20=D0=BC?=
 =?UTF-8?q?=D0=B0=D1=81=D1=81=D0=B8=D0=B2=20+=20=D0=B2=D0=B0=D0=BB=D0=B8?=
 =?UTF-8?q?=D0=B4=D0=B0=D1=86=D0=B8=D1=8F=20serviceId=20(int>0)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 site/config/loader.py           | 2 +-
 site/routes/instances_routes.py | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/site/config/loader.py b/site/config/loader.py
index 89096c2..41e63f8 100644
--- a/site/config/loader.py
+++ b/site/config/loader.py
@@ -80,7 +80,7 @@ SERVICES = _DF["SERVICES"]
 OPS_INDEX = _DF["OPS_INDEX"]
 
 DELAY = float(os.getenv("MOCK_OP_DELAY", "0.1"))
-VERSION = "0.5.3"
+VERSION = "0.5.4"
 
 
 def get_services(stand_id):
diff --git a/site/routes/instances_routes.py b/site/routes/instances_routes.py
index 3871d7f..183a405 100644
--- a/site/routes/instances_routes.py
+++ b/site/routes/instances_routes.py
@@ -72,6 +72,11 @@ def create_instance():
     на случай если заголовок не дойдёт.
     """
     body = request.get_json(silent=True) or {}
+
+    # ⛔ body должен быть dict, не массив и не примитив
+    if not isinstance(body, dict):
+        return jsonify({"error": "request body must be a JSON object"}), 400
+
     service_id = body.get("serviceId")
     display_name = body.get("displayName", "unnamed")
 
@@ -79,6 +84,10 @@ def create_instance():
     if service_id is None:
         return jsonify({"error": "serviceId is required"}), 400
 
+    # Валидация: serviceId должен быть целым положительным числом
+    if not isinstance(service_id, int) or isinstance(service_id, bool) or service_id <= 0:
+        return jsonify({"error": "serviceId must be a positive integer"}), 400
+
     # Проверка что сервис существует в конфиге
     svc_def = SERVICES.get(service_id)
     if not svc_def: