[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

Committed by Hermes autonomous QA sprint 2026-08-13.
These files were modified during the Aug 12 sprint but never committed.

dashcaddy-api/routes/workflows.js

@@ -1,5 +1,20 @@
 const express = require('express');
 const { ok } = require('../src/utils/responses');
+const { ValidationError } = require('../src/utilities/errors');
+
+/**
+ * Validate a workflow ID.
+ * @param {string} workflowId - Workflow ID from route param
+ * @throws {ValidationError} if the ID contains unsafe characters
+ */
+function validateWorkflowId(workflowId) {
+  if (!workflowId || typeof workflowId !== 'string') {
+    throw new ValidationError('Workflow ID is required');
+  }
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(workflowId)) {
+    throw new ValidationError('Invalid workflow ID format');
+  }
+}
 
 /**
  * Workflows routes factory
@@ -27,6 +42,7 @@ module.exports = function({ workflowEngine, licenseManager, asyncHandler, ok })
   // Enable a workflow
   router.post('/workflows/:workflowId/enable', asyncHandler(async (req, res) => {
     const { workflowId } = req.params;
+    validateWorkflowId(workflowId);
     const result = workflowEngine.setWorkflowEnabled(workflowId, true);
     ok(res, result);
   }, 'workflows-enable'));
@@ -34,6 +50,7 @@ module.exports = function({ workflowEngine, licenseManager, asyncHandler, ok })
   // Disable a workflow
   router.post('/workflows/:workflowId/disable', asyncHandler(async (req, res) => {
     const { workflowId } = req.params;
+    validateWorkflowId(workflowId);
     const result = workflowEngine.setWorkflowEnabled(workflowId, false);
     ok(res, result);
   }, 'workflows-disable'));
@@ -41,6 +58,7 @@ module.exports = function({ workflowEngine, licenseManager, asyncHandler, ok })
   // Manually trigger a workflow
   router.post('/workflows/:workflowId/run', asyncHandler(async (req, res) => {
     const { workflowId } = req.params;
+    validateWorkflowId(workflowId);
     const triggerData = req.body || {};
     triggerData.trigger = 'manual';