fix(subscriptions): reject unscoped batch replacement

docs/contracts/subscription.json

@@ -79,7 +79,7 @@
             "notes": [
               "Preferred mutation endpoint for batch subscribe, unsubscribe, and replace/update flows.",
               "Accepts action plus sectionIds and/or mixed section/course codes.",
-              "action=set replaces only the requested semester when semesterId is present, preserving subscriptions from every other semester; without semesterId it retains the compatibility behavior of replacing the full set.",
+              "action=set requires semesterId and replaces only the requested semester, preserving subscriptions from every other semester.",
               "A semester-scoped action=set may omit sectionIds/codes to clear only that semester."
             ]
           },

src/lib/api/schemas/request-user-mutation-schemas.ts

@@ -63,7 +63,18 @@ export const calendarSubscriptionBatchRequestSchema =
       action: calendarSubscriptionBatchActionSchema,
     })
     .superRefine((input, context) => {
-      if (input.action === "set" || hasCalendarSubscriptionSelection(input)) {
+      if (input.action === "set") {
+        if (input.semesterId === undefined) {
+          context.addIssue({
+            code: "custom",
+            message: "semesterId is required when action is set",
+            path: ["semesterId"],
+          });
+        }
+        return;
+      }
+
+      if (hasCalendarSubscriptionSelection(input)) {
         return;
       }
 

tests/e2e/src/app/api/calendar-subscriptions/test.ts

@@ -241,6 +241,22 @@ test.describe("日历订阅 API", () => {
         data: { sectionIds: [currentSection.id, previousSection.id] },
       });
       expect(setupResponse.status()).toBe(200);
+
+      const unscopedSetResponse = await page.request.post(BATCH_BASE, {
+        data: { action: "set", sectionIds: [] },
+      });
+      expect(unscopedSetResponse.status()).toBe(400);
+      const preservedBody = (await (
+        await page.request.get("/api/calendar-subscriptions/current")
+      ).json()) as {
+        subscription?: { sections?: Array<{ id?: number }> } | null;
+      };
+      const preservedIds =
+        preservedBody.subscription?.sections?.map((section) => section.id) ??
+        [];
+      expect(preservedIds).toContain(currentSection.id);
+      expect(preservedIds).toContain(previousSection.id);
+
       const currentSemesterId = currentSection.semesterId;
 
       const response = await page.request.post(BATCH_BASE, {

tests/unit/api-schemas.test.ts

@@ -452,9 +452,18 @@ describe("其他请求 schema", () => {
       }).success,
     ).toBe(true);
     expect(
-      calendarSubscriptionBatchRequestSchema.safeParse({ action: "set" })
-        .success,
+      calendarSubscriptionBatchRequestSchema.safeParse({
+        action: "set",
+        semesterId: 12,
+      }).success,
     ).toBe(true);
+    const unscopedSet = calendarSubscriptionBatchRequestSchema.safeParse({
+      action: "set",
+    });
+    expect(unscopedSet.success).toBe(false);
+    if (!unscopedSet.success) {
+      expect(unscopedSet.error.issues[0]?.path).toEqual(["semesterId"]);
+    }
     expect(
       calendarSubscriptionBatchRequestSchema.safeParse({ action: "remove" })
         .success,