Changeset 0.22.0 (#93)

server/handlers/channels.go

@@ -320,7 +320,7 @@ func (h *ChannelHandler) CreateChannel(c *gin.Context) {
 		).Scan(
 			&ch.ID, &ch.UserID, &ch.Title, &ch.Type, &ch.Description, &ch.Model, &ch.APIConfigID,
 			&ch.SystemPrompt, &ch.IsArchived, &ch.IsPinned, &ch.Folder, &ch.ProjectID, &ch.WorkspaceID,
-			pq.Array(&tags), &ch.Settings, &ch.CreatedAt, &ch.UpdatedAt,
+			pq.Array(&tags), scanJSON(&ch.Settings), &ch.CreatedAt, &ch.UpdatedAt,
 		)
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create channel"})
@@ -478,6 +478,11 @@ func (h *ChannelHandler) UpdateChannel(c *gin.Context) {
 		addClause("tags", writeTagsArg(req.Tags))
 	}
 	if req.Settings != nil {
+		// Validate settings is well-formed JSON before writing
+		if !json.Valid([]byte(*req.Settings)) {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "settings must be valid JSON"})
+			return
+		}
 		// JSONB merge: new settings keys overwrite existing, unmentioned keys preserved
 		if database.IsSQLite() {
 			setClauses = append(setClauses, "settings = json_patch(settings, ?)")