fix: reject array fields in GET and DELETE room requests

cmd/protocolgen/idl.go

@@ -772,7 +772,7 @@ func (d *idl) checkRoomRoute(where string, m *message, names endpointNames) erro
 	}
 	if b.Method == "GET" || b.Method == "DELETE" {
 		for _, name := range slices.Sorted(maps.Keys(m.Request.Properties)) {
-			if d.jsonType(m.Request.Properties[name]) == "object" {
+			if t := d.jsonType(m.Request.Properties[name]); t != "string" && t != "integer" {
 				return fmt.Errorf("%s：%s 请求的字段 %s 来自路径或查询串，应是字符串、整数或枚举", where, b.Method, name)
 			}
 		}
@@ -780,7 +780,7 @@ func (d *idl) checkRoomRoute(where string, m *message, names endpointNames) erro
 	return names.addRoute(where, b, "房间内请求 "+m.Type+" 的路由")
 }
 
-// 请求的字段已经检查过，不会是数组、布尔或 null，所以只有 string、integer 和 object 三种。
+// 请求的字段已经检查过，不会是 null、布尔或数字，所以只有 string、integer、object 和 array 四种。
 func (d *idl) jsonType(s *schema) string {
 	if s.Ref != "" {
 		return d.Defs[refName(s.Ref)].Type

cmd/protocolgen/idl_test.go

@@ -246,6 +246,11 @@ func TestParseIDLRejects(t *testing.T) {
 			defs(d)["Track"] = object(map[string]any{"source": ref("Kind"), "id": str()}, "source", "id")
 			d["x-requests"] = []any{roomBinding("GET", "/api/room", map[string]any{"track": ref("Track")}, "track")}
 		}, "x-requests[0].http：GET 请求的字段 track 来自路径或查询串，应是字符串、整数或枚举"},
+		{"DELETE 请求有数组字段", func(d map[string]any) {
+			withKind(d)
+			kinds := map[string]any{"type": "array", "items": ref("Kind"), "maxItems": 10}
+			d["x-requests"] = []any{roomBinding("DELETE", "/api/room/queue", map[string]any{"kinds": kinds}, "kinds")}
+		}, "x-requests[0].http：DELETE 请求的字段 kinds 来自路径或查询串，应是字符串、整数或枚举"},
 		{"204 的房间内请求有响应", func(d map[string]any) {
 			m := roomBinding("POST", "/api/room/messages", map[string]any{})
 			m["http"].(map[string]any)["status"] = 204