fix(disputes): validate evidence URLs, reject duplicates, cap per-dispute evidence (closes #1609)

[rudrasatani13]

Closes #1609.

One thing worth knowing before you review: another contributor asked to be assigned this issue on 10 September and never opened a pull request (no assignee was ever set, and a repo-wide PR search for this issue returns only this one). If you would rather they take it, say so and I will close this.

What was missing

attachEvidence checked the MIME type and the file size, and nothing else:

• The stored fileUrl was whatever string arrived. The DTO's @IsUrl() rejects obvious garbage, but that is a transport-layer check - the service itself accepted any scheme it was handed, so ftp: or javascript: URLs would be persisted and later rendered to participants and arbiters.
• The same file could be attached to the same dispute repeatedly.
• Nothing bounded how many evidence records one dispute could accumulate.

What changed

• normalizeEvidenceUrl() - parses the URL, requires http/https, requires a hostname, rejects anything longer than the 2048-character column, and stores the normalised form rather than the raw string.
• assertEvidenceIsNew() - rejects a duplicate (disputeId, fileUrl) pair.
• assertEvidenceCountAllowed() - caps a dispute at DISPUTE_EVIDENCE_MAX_COUNT (default 10), read through the same ConfigService pattern as the existing MIME and size settings.
• The MIME allow-list, the size limit, the participant gate and the PENDING-only rule are untouched.

Tests

Three new cases in disputes.service.spec.ts: a non-http(s) scheme is rejected and nothing is persisted, a duplicate URL is rejected before the write, and the cap is enforced at the boundary. The evidence repository mock gained the findOne/count the new checks use.

Verification:

• npx jest src/disputes -> 2 suites, 65 tests passing.
• npx tsc --noEmit -> the same 66 pre-existing errors as before this branch, none in the files touched here.

Assignment and reward are not confirmed on my side, so please treat this as a voluntary contribution.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
insight-arena-4rll	Ready	Preview	Sep 13, 2026 3:05pm UTC