Edge Case: Chatbot API Security and Error Handling

  Property: ChurchWiseAI   Category: Security Tier: all Persona: security-tester Touchpoint: /api/chatbot/stream

Preconditions

• Chatbot API endpoint is live
• Demo church exists with ID in test data

Steps

#	Action	Expected Result
1	Send request missing churchId parameter	API returns 400 Bad Request. Error message indicates missing required field.
2	Send request missing sessionId parameter	API returns 400 Bad Request. Error message indicates missing required field.
3	Send request missing message parameter	API returns 400 Bad Request. Error message indicates missing required field.
4	Send request with nonexistent churchId	API returns 404 Not Found. No error response leaks database structure.
5	Send valid request with all required fields	API returns 200 OK with AI response, or 403 if chatbot disabled on demo. No 500 error.
6	Send request with agentType=prayer	API routes to prayer agent. Returns status < 500 (no crash). Response uses care/prayer tone.
7	Send request with agentType=visitor (unknown agent)	API handles gracefully. Returns 400 (invalid agent type) or defaults to main agent. No 500.
8	Send oversized message (>2000 chars)	API returns 400 with message 'Message too long'. No truncation, no silent failure.
9	Send message with XSS payload in text	API accepts message. No 500 error. Response is properly escaped when rendered.

Known Failure Modes

• Missing required fields returns 500 instead of 400 — poor error handling
• Nonexistent church returns 500 — information disclosure vulnerability
• Oversized message crashes API — DoS vector
• Agent type routing crashes — uncaught error on unknown types

References

• Playwright spec: e2e/edge-chatbot.spec.ts
• Code files:
  • src/app/api/chatbot/stream/route.ts
  • src/lib/chatbot-handler.ts
  • src/lib/input-validation.ts

Notes

Tests chatbot API edge cases: missing/invalid inputs, unknown agent types, message size limits, and error handling. API must validate all inputs, return appropriate error codes (400/404 vs 500), and never crash or leak information. XSS in chat messages must be handled safely at render time.