From aed9732302630f091cd9c51e42aa7147d2afd769 Mon Sep 17 00:00:00 2001
From: Wells Bunker <wells@buster.so>
Date: Fri, 26 Sep 2025 09:41:14 -0600
Subject: [PATCH] adding optional password on metric_file/[id]/data endpoint

---
 apps/server/src/api/v2/metric_files/[id]/data/GET.ts  | 11 +++++++++--
 .../api/v2/metric_files/[id]/data/get-metric-data.ts  |  5 +++--
 packages/server-shared/src/metrics/responses.types.ts |  3 ++-
 3 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/apps/server/src/api/v2/metric_files/[id]/data/GET.ts b/apps/server/src/api/v2/metric_files/[id]/data/GET.ts
index b9b6a2b3f..99da3a296 100644
--- a/apps/server/src/api/v2/metric_files/[id]/data/GET.ts
+++ b/apps/server/src/api/v2/metric_files/[id]/data/GET.ts
@@ -12,10 +12,17 @@ const app = new Hono()
     zValidator('query', MetricDataQuerySchema),
     async (c) => {
       const { id } = c.req.valid('param');
-      const { limit, version_number, report_file_id } = c.req.valid('query');
+      const { limit, version_number, report_file_id, password } = c.req.valid('query');
       const user = c.get('busterUser');
 
-      const response = await getMetricDataHandler(id, user, limit, version_number, report_file_id);
+      const response = await getMetricDataHandler(
+        id,
+        user,
+        limit,
+        version_number,
+        report_file_id,
+        password
+      );
 
       return c.json(response);
     }
diff --git a/apps/server/src/api/v2/metric_files/[id]/data/get-metric-data.ts b/apps/server/src/api/v2/metric_files/[id]/data/get-metric-data.ts
index 98b3042ad..8e5dd95ac 100644
--- a/apps/server/src/api/v2/metric_files/[id]/data/get-metric-data.ts
+++ b/apps/server/src/api/v2/metric_files/[id]/data/get-metric-data.ts
@@ -36,7 +36,8 @@ export async function getMetricDataHandler(
   user: User,
   limit = 5000,
   versionNumber?: number,
-  reportFileId?: string
+  reportFileId?: string,
+  password?: string
 ): Promise<MetricDataResponse> {
   // Retrieve metric definition from database with data source info
   const metric = await getMetricWithDataSource({ metricId, versionNumber });
@@ -63,7 +64,7 @@ export async function getMetricDataHandler(
     publiclyAccessible: metric.publiclyAccessible,
     publicExpiryDate: metric.publicExpiryDate ?? undefined,
     publicPassword: metric.publicPassword ?? undefined,
-    userSuppliedPassword: undefined,
+    userSuppliedPassword: password,
   });
 
   if (!hasAccess) {
diff --git a/packages/server-shared/src/metrics/responses.types.ts b/packages/server-shared/src/metrics/responses.types.ts
index 2f0f0f18c..4ba68f80a 100644
--- a/packages/server-shared/src/metrics/responses.types.ts
+++ b/packages/server-shared/src/metrics/responses.types.ts
@@ -54,8 +54,9 @@ export type MetricDataParams = z.infer<typeof MetricDataParamsSchema>;
  */
 export const MetricDataQuerySchema = z.object({
   limit: z.coerce.number().min(1).max(5000).default(5000).optional(),
-  version_number: z.coerce.number().optional(),
+  version_number: z.coerce.number().int().min(1).optional(),
   report_file_id: z.string().uuid().optional(),
+  password: z.string().min(1).optional(),
 });
 
 export type MetricDataQuery = z.infer<typeof MetricDataQuerySchema>;