Inline chat moderation request returning 500s (#4412)

* Initial plan

* Initial analysis of inline chat moderation 500 error issue

Co-authored-by: gabek <414923+gabek@users.noreply.github.com>

* Fix inline chat moderation 500 errors by supporting Authorization header tokens

- Modified RequireUserModerationScopeAccesstoken middleware to check both Authorization header (Bearer tokens) and URL query parameters
- This fixes the issue where inline chat moderation from the web UI was failing with 500 errors
- Maintains backward compatibility with existing code that uses query parameter tokens
- The fix aligns the chat endpoint behavior with the integrations endpoint which already supported Bearer tokens

Addresses the wiring issue between OpenAPI spec and API implementation identified in issue comments.

Co-authored-by: gabek <414923+gabek@users.noreply.github.com>

* Fix inline chat moderation 500 errors by adding nil pointer checks

Co-authored-by: gabek <414923+gabek@users.noreply.github.com>

* Fix nil pointer vulnerabilities across all OpenAPI endpoints

Co-authored-by: gabek <414923+gabek@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: gabek <414923+gabek@users.noreply.github.com>

webserver/handlers/admin/appearance.go

@@ -23,6 +23,11 @@ func SetCustomColorVariableValues(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if values.Value == nil {
+		webutils.WriteSimpleResponse(w, false, "value field is required")
+		return
+	}
+
 	configRepository := configrepository.Get()
 	if err := configRepository.SetCustomColorVariableValues(*values.Value); err != nil {
 		webutils.WriteSimpleResponse(w, false, err.Error())

webserver/handlers/admin/chat.go

@@ -44,6 +44,11 @@ func UpdateMessageVisibility(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if request.IdArray == nil || request.Visible == nil {
+		webutils.WriteSimpleResponse(w, false, "missing required fields: idArray and visible are required")
+		return
+	}
+
 	if err := chat.SetMessagesVisibility(*request.IdArray, *request.Visible); err != nil {
 		webutils.WriteSimpleResponse(w, false, err.Error())
 		return

webserver/handlers/admin/emoji.go

@@ -26,6 +26,16 @@ func UploadCustomEmoji(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if emoji.Data == nil {
+		webutils.WriteSimpleResponse(w, false, "data field is required")
+		return
+	}
+
+	if emoji.Name == nil {
+		webutils.WriteSimpleResponse(w, false, "name field is required")
+		return
+	}
+
 	bytes, _, err := utils.DecodeBase64Image(*emoji.Data)
 	if err != nil {
 		webutils.WriteSimpleResponse(w, false, err.Error())

webserver/handlers/admin/externalAPIUsers.go

@@ -25,6 +25,16 @@ func CreateExternalAPIUser(w http.ResponseWriter, r *http.Request) {
 
 	userRepository := userrepository.Get()
 
+	if request.Scopes == nil {
+		webutils.BadRequestHandler(w, errors.New("scopes field is required"))
+		return
+	}
+
+	if request.Name == nil {
+		webutils.BadRequestHandler(w, errors.New("name field is required"))
+		return
+	}
+
 	// Verify all the scopes provided are valid
 	if !userRepository.HasValidScopes(*request.Scopes) {
 		webutils.BadRequestHandler(w, errors.New("one or more invalid scopes provided"))
@@ -85,7 +95,12 @@ func DeleteExternalAPIUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if request.Token != nil && *request.Token == "" {
+	if request.Token == nil {
+		webutils.BadRequestHandler(w, errors.New("token field is required"))
+		return
+	}
+
+	if *request.Token == "" {
 		webutils.BadRequestHandler(w, errors.New("must provide a token"))
 		return
 	}

webserver/handlers/playbackMetrics.go

@@ -29,7 +29,12 @@ func ReportPlaybackMetrics(w http.ResponseWriter, r *http.Request) {
 
 	clientID := utils.GenerateClientIDFromRequest(r)
 
+	if request.Errors == nil {
+		webutils.WriteSimpleResponse(w, false, "errors field is required")
+		return
+	}
 	metrics.RegisterPlaybackErrorCount(clientID, *request.Errors)
+
 	if request.Bandwidth != nil && *request.Bandwidth != 0.0 {
 		metrics.RegisterPlayerBandwidth(clientID, *request.Bandwidth)
 	}
@@ -42,5 +47,9 @@ func ReportPlaybackMetrics(w http.ResponseWriter, r *http.Request) {
 		metrics.RegisterPlayerSegmentDownloadDuration(clientID, *request.DownloadDuration)
 	}
 
+	if request.QualityVariantChanges == nil {
+		webutils.WriteSimpleResponse(w, false, "qualityVariantChanges field is required")
+		return
+	}
 	metrics.RegisterQualityVariantChangesCount(clientID, *request.QualityVariantChanges)
 }

webserver/handlers/remoteFollow.go

@@ -26,7 +26,12 @@ func RemoteFollow(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if request.Account != nil && *request.Account == "" {
+	if request.Account == nil {
+		webutils.WriteSimpleResponse(w, false, "account field is required")
+		return
+	}
+
+	if *request.Account == "" {
 		webutils.WriteSimpleResponse(w, false, "Remote Fediverse account is required to follow.")
 		return
 	}