[Bug]price_id Field Accepts Chinese Characters (Invalid Input Not Rejected)

[Unmeiwa]

Description

The price_id field in the /v1/devices API endpoint accepts Chinese characters (and potentially other non-ASCII characters) despite being documented as a string type with no explicit validation rules. This may lead to inconsistent data or billing issues, as price_id is intended for Stripe pricing IDs (which should typically follow alphanumeric/standard formats).

Steps to Reproduce

Steps to reproduce the behavior:
1.Send a POST request to https://api.stayforge.net/v1/devices/... with a JSON body containing price_id with Chinese characters (e.g., "price_id": "pricdee二hly").
2.Observe that the API accepts the request and creates the device with the invalid price_id.

Request Body Example
{
"device_id": "uacxc",
"sn": "SN202501是2002",
"display_name": "一百一十四楼温度传感器",
"price_id": "pricdee二hly", // Contains Chinese characters
"status": "active",
"metadata": {}
}

Actual Behavior

The API accepts the price_id with Chinese characters and creates the device successfully (status 201 Created).

Expected Behavior

The API should validate price_id to ensure it conforms to expected formats (e.g., Stripe’s pricing ID pattern, typically alphanumeric with possible hyphens/underscores).
If invalid characters (like Chinese) are provided, the API should return an error (e.g., 400 Bad Request) with a clear validation message.

Environment (if applicable)

• OS:Windows11
• Browser / Tool:Chrome/Postman
• SDK / Client:
• Other relevant details:

Additional Context

The sn and display_name fields also accept Chinese characters, but this may be intentional (unlike price_id).
The device_id field correctly enforces alphanumeric/hyphen/underscore patterns (as per its pattern constraint).

[Iktahana]

Issue Verification: CONFIRMED ✓

The bug is real. The price_id field accepts Chinese characters without validation. Looking at the codebase:

Location: /internal/handlers/devices/devices.go (lines 771-772) and OpenAPI schema

Current behavior:

• price_id field is stored directly without any format/pattern validation
• OpenAPI schema only has type: string with no pattern or format constraint
• Unlike Stripe price IDs which follow a strict format (e.g., price_1A2b3C4d), the API accepts any string

Root cause: Missing input validation. No pattern defined to match Stripe pricing ID format.

Recommendation: Add pattern validation for price_id to match Stripes pricing ID format (typically price_ followed by alphanumeric characters), or add explicit documentation if free-form strings are intentional.