apps/backend/package.json

@@ -31,6 +31,7 @@
     "@prisma/client": "^5.19.1",
     "bcryptjs": "^2.4.3",
     "fastify": "^4.28.1",
+    "fastify-plugin": "^4.5.1",
     "fastify-type-provider-zod": "^2.0.0",
     "nanoid": "^5.0.7",
     "node-cron": "^3.0.3",

apps/backend/src/modules/images/og.service.ts

@@ -16,6 +16,13 @@ interface DownloadResult {
   contentType: string;
 }
 
+function getOgImageUrl(ogImage: unknown): string | undefined {
+  const entry = Array.isArray(ogImage) ? ogImage[0] : ogImage;
+  if (!entry || typeof entry !== 'object') return undefined;
+  const { url } = entry as { url?: unknown };
+  return typeof url === 'string' ? url : undefined;
+}
+
 async function downloadImage(url: string): Promise<DownloadResult | null> {
   try {
     const controller = new AbortController();
@@ -27,7 +34,7 @@ async function downloadImage(url: string): Promise<DownloadResult | null> {
         headers: { 'user-agent': 'FamilyWishlistBot/1.0 (+image-fetch)' },
       });
       if (res.statusCode >= 400) return null;
-      const contentType = (res.headers['content-type']?.toString() ?? '').split(';')[0].trim();
+      const contentType = ((res.headers['content-type']?.toString() ?? '').split(';')[0] ?? '').trim();
       if (!ALLOWED_MIME.has(contentType)) return null;
       const chunks: Buffer[] = [];
       let total = 0;
@@ -60,8 +67,7 @@ export async function fetchOgImageForWish(
   try {
     const parsed = await ogs({ url: pageUrl, timeout: FETCH_TIMEOUT_MS });
     if (parsed.error || !parsed.result) return;
-    const imageEntry = parsed.result.ogImage;
-    const imageUrl = Array.isArray(imageEntry) ? imageEntry[0]?.url : imageEntry?.url;
+    const imageUrl = getOgImageUrl(parsed.result.ogImage);
     if (!imageUrl) return;
 
     const absolute = new URL(imageUrl, pageUrl).toString();

apps/backend/src/plugins/auth.ts

@@ -1,6 +1,7 @@
 import fp from 'fastify-plugin';
 import fastifyJwt from '@fastify/jwt';
 import fastifyCookie from '@fastify/cookie';
+import type { FastifyReply } from 'fastify';
 import { env } from '../config/env.js';
 import { UnauthorizedError } from '../utils/errors.js';
 
@@ -28,7 +29,7 @@ export default fp(async (app) => {
   });
 
   // helpers for routes
-  app.decorate('setAuthCookie', ((reply, token) => {
+  app.decorate('setAuthCookie', ((reply: FastifyReply, token: string) => {
     reply.setCookie(AUTH_COOKIE, token, {
       httpOnly: true,
       secure: env.NODE_ENV === 'production',
@@ -38,7 +39,7 @@ export default fp(async (app) => {
     });
   }) as never);
 
-  app.decorate('clearAuthCookie', ((reply) => {
+  app.decorate('clearAuthCookie', ((reply: FastifyReply) => {
     reply.clearCookie(AUTH_COOKIE, { path: '/' });
   }) as never);
 });