[BUG-PC-002][FR-15][PUT /api/products/:id] Invalid required product fields are accepted and persisted

[AkiraTomori]

Summary

The Update Product endpoint accepts missing and invalid required fields and persists corrupt product state.

• Severity: High
• Environment: Local Docker eshop-sut-backend-1
• HW06 Pool: Pool C / FR-15
• Failed cases: 18 cases under PC-F-VALID-001

Preconditions

Disposable product 101 and category 1 exist. A controlled valid administrator JWT and the collection-level student header are supplied.

Steps to reproduce

1. Send PUT /api/products/101 with valid admin authorization and no request body.
2. Record the response.
3. Inspect only product 101 through the restricted SQLite snapshot.
4. Repeat from a clean fixture with isolated invalid values such as price: -1, a 256-character name, or category_id: 999999.

Expected result

Reject with a 4xx validation response and preserve product state. Exact status/schema is unspecified.

Actual result

FR15-DOM-002 returned HTTP 200 with a success message and persisted null for all product fields. Seventeen additional invalid name, price, category, type, and envelope cases also returned 200 and persisted invalid values.

Impact

Null, oversized, non-positive, wrong-type, and referentially invalid product data can enter the catalog.

Evidence

• 23127379_Homework/HW6/Pool-C_FR15_Update_Product/postman/newman/Pool-C_FR15_report.json
• 23127379_Homework/HW6/Pool-C_FR15_Update_Product/postman/newman/Pool-C_FR15_report.html
• 23127379_Homework/HW6/Pool-C_FR15_Update_Product/evidence/Pool-C_FR15_per-case-state.json
• Screenshot generated from the FR15-DOM-002 failure with MSSV 23127379.

Related Issues 42/43 concern POST create-price validation, and Issue 55 concerns UI feedback; this report covers the distinct PUT endpoint and broader required-field/type/category set.

Requirement sources: README FR-15; API specification §3.3
Suggested labels: bug, validation, data-integrity, FR-15, api

[AkiraTomori]

HW06 screenshot evidence — MSSV 23127379

Repository source: BUG-PC-002_23127379.png

The screenshot summarizes the redacted Newman/fixture evidence recorded in the HW06 Pool artifacts; it does not expose OTPs, passwords, tokens, or personal email addresses.