fix: add validation for session questions and normalize user ID access across controllers

backend/controllers/questionController.js

@@ -23,7 +23,14 @@ const Session = require("../models/Session");
 const addQuestionToSession = async (req, res) => {
   try {
     const { sessionId, questions } = req.body;
-
+
+    if (!sessionId || !Array.isArray(questions) || questions.length === 0) {
+      return res.status(400).json({
+        success: false,
+        message: "Valid sessionId and non-empty questions array are required.",
+      });
+    }
+
     const session = await Session.findById(sessionId);
 
     if (!session) {
@@ -65,6 +72,11 @@ const addQuestionToSession = async (req, res) => {
 const togglePinQuestion = async (req, res) => {
   try {
     const question = await Question.findById(req.params.id);
+    if (!question) {
+      return res
+        .status(404)
+        .json({ success: false, message: "Question not found" });
+    }
 
     const session = await Session.findById(question.session);
     if (!session) {
@@ -73,7 +85,7 @@ const togglePinQuestion = async (req, res) => {
         .json({ success: false, message: "Session not found" });
     }
 
-    if (session.user.toString() !== req.user.id) {
+    if (session.user.toString() !== req.user._id.toString()) {
       return res.status(403).json({
         success: false,
         message: "Unauthorized access",
@@ -124,7 +136,7 @@ const updateQuestionNote = async (req, res) => {
         .json({ success: false, message: "Session not found" });
     }
 
-    if (session.user.toString() !== req.user.id) {
+    if (session.user.toString() !== req.user._id.toString()) {
       return res.status(403).json({
         success: false,
         message: "Unauthorized access",

backend/controllers/resumeController.js

@@ -203,7 +203,7 @@ const Resume = require("../models/Resume");
 const saveResume = async (req, res) => {
     try {
         const { title, latexCode, resumeId } = req.body;
-        const userId = req.user._id || req.user.id;
+        const userId = req.user._id;
 
         if (!title || !latexCode) {
             return res.status(400).json({ success: false, message: "Title and LaTeX code are required." });
@@ -249,7 +249,7 @@ const saveResume = async (req, res) => {
  */
 const getMyResumes = async (req, res) => {
     try {
-        const userId = req.user._id || req.user.id;
+        const userId = req.user._id;
         const resumes = await Resume.find({ user: userId }).sort({ updatedAt: -1 });
         res.status(200).json({ success: true, resumes });
     } catch (error) {

backend/controllers/sessionController.js

@@ -91,7 +91,7 @@ exports.createSession = async (req, res) => {
  */
 exports.getMySessions = async (req, res) => {
     try {
-      const userId = req.user._id || req.user.id;
+      const userId = req.user._id;
       const session = await Session.find({ user: userId })
         .sort({ createdAt: -1 })
         .populate("questions");
@@ -160,10 +160,10 @@ exports.deleteSession = async (req, res) => {
             const { id } = req.params;
             const userId = req.user._id;
 
-            const session = await Session.findOne({
-                _id: id,
-                user: userId,
-            }).session(transaction);
+          const session = await Session.findOne({
+              _id: id,
+              user: userId,
+          }).session(transaction);
 
             if (!session) {
                 throw new Error("SESSION_NOT_FOUND");