feat(security): harden the API, trust Hiboutik for deletions, lock syncs (#3)

src/hiboutik/hiboutik.client.ts

@@ -33,6 +33,17 @@ export class HiboutikClient {
     return response.data;
   }
 
+  /**
+   * GET on a list endpoint. HTTP errors (4xx/5xx) throw, a 2xx answer without body is an empty list, and any other
+   * non-list body throws: an empty list triggers deletions in the sync, so it must never be inferred from a malformed answer.
+   */
+  async getList<T>(path: string, params?: Record<string, unknown>): Promise<T[]> {
+    const data = await this.get<T[] | '' | null | undefined>(path, params);
+    if (data === '' || data == null) return [];
+    if (!Array.isArray(data)) throw new Error(`Unexpected answer from Hiboutik ${path}: a list was expected`);
+    return data;
+  }
+
   /**
    * Fetches every page of a paginated endpoint (`p` param, starting at 1) and concatenates the results.
    * Only for paginated endpoints: on a non-paginated one, a full first page would loop forever on the same results.
@@ -42,8 +53,8 @@ export class HiboutikClient {
     let page = 1;
 
     while (true) {
-      const pageData = await this.get<T[]>(path, { ...baseParams, p: page });
-      if (!pageData || pageData.length === 0) break;
+      const pageData = await this.getList<T>(path, { ...baseParams, p: page });
+      if (pageData.length === 0) break;
       results.push(...pageData);
       // A page smaller than the page size is the last one: no need to request an empty page
       if (pageData.length < HIBOUTIK_PAGE_SIZE) break;