From b0dcc2dd3a19a26b3e4898ccd1d34041b1e91e93 Mon Sep 17 00:00:00 2001
From: Vladimir Zagainov <mrixs@mrixs.ru>
Date: Tue, 18 Aug 2026 19:59:12 +0300
Subject: [PATCH] fix: address code review findings

---
 cmd/api/handlers.go | 20 ++++++++++++++++++++
 cmd/api/main.go     |  2 +-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/cmd/api/handlers.go b/cmd/api/handlers.go
index c2712cb..a520f42 100644
--- a/cmd/api/handlers.go
+++ b/cmd/api/handlers.go
@@ -560,6 +560,10 @@ func GetSavedCities(hc *HandlerContext, w http.ResponseWriter, r *http.Request)
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	cities, err := hc.Preferences.GetSavedCities(r.Context(), userID)
 	if err != nil {
@@ -580,6 +584,10 @@ func AddSavedCity(hc *HandlerContext, w http.ResponseWriter, r *http.Request) {
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	var req struct {
 		CityCode string `json:"city_code"`
@@ -607,6 +615,10 @@ func RemoveSavedCity(hc *HandlerContext, w http.ResponseWriter, r *http.Request)
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	parts := strings.Split(r.URL.Path, "/")
 	// Expected: /v1/preferences/saved-cities/{city_code} -> parts: ["", "v1", "preferences", "saved-cities", "{city_code}"]
@@ -633,6 +645,10 @@ func GetSearchHistory(hc *HandlerContext, w http.ResponseWriter, r *http.Request
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	history, err := hc.Preferences.GetSearchHistory(r.Context(), userID)
 	if err != nil {
@@ -653,6 +669,10 @@ func AddSearchHistory(hc *HandlerContext, w http.ResponseWriter, r *http.Request
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	var req struct {
 		FromCity string `json:"from_city"`
diff --git a/cmd/api/main.go b/cmd/api/main.go
index 39c717f..9afbea0 100644
--- a/cmd/api/main.go
+++ b/cmd/api/main.go
@@ -21,7 +21,7 @@ func main() {
 
 	apiKey := os.Getenv("YANDEX_API_KEY")
 	if apiKey == "" {
-		apiKey = "default-key" // fallback for development
+		log.Fatal("YANDEX_API_KEY environment variable is not set")
 	}
 	yandexClient := yandex.NewClient(apiKey, yandex.WithMetrics(m))