fix(batchController): validate date-range and allow-list sort on GET /batches

[saidai-bhuvanesh]

Summary

Fixes #1237

getAllBatches (backend/controllers/batchController.js) parsed start/end with bare new Date(start) and passed the raw client sortBy straight into .sort({...}):

• GET /api/batches?start=notadate → Mongoose CastError → 500.
• GET /api/batches?sortBy=<arbitrary-key> → arbitrary/malformed sort field forwarded into the query.

Fix

• Dates: validate with Number.isNaN(date.getTime()) and return 400 with a clear message for invalid start/end; empty/absent ends no longer leave an empty createdAt object on the query.
• Sort: restrict sortBy to an allow-list of real fields (createdAt, updatedAt, batchId, cropType, quantity, farmerName, status, currentStage), falling back to createdAt for anything else. Default behaviour (no sortBy → createdAt desc) is unchanged.

- if (start) { query.createdAt.$gte = new Date(start); }
- if (end) { query.createdAt.$lte = new Date(end); }
+ if (start) {
+   const startDateObj = new Date(start);
+   if (Number.isNaN(startDateObj.getTime())) return res.status(400).json(apiResponse.errorResponse("Invalid 'start' date..."));
+   query.createdAt.$gte = startDateObj;
+ }
+ const ALLOWED_SORT_FIELDS = new Set(["createdAt", "updatedAt", "batchId", ...]);
+ const safeSortBy = ALLOWED_SORT_FIELDS.has(sortBy) ? sortBy : "createdAt";
+ sort[safeSortBy] = sortOrder.toLowerCase() === "asc" ? 1 : -1;

Also fixes a pre-existing syntax error

The file on main ends with an orphaned top-level .catch(err => console.error("Promise.all failed:", err)); (not attached to any Promise), which is invalid JS and made the whole module fail to load (SyntaxError: Unexpected token '.'). I removed this dead line so the file compiles; without this, neither my change nor the existing handler could run. The existing exports.* assignments continue to define module.exports.

Files

• backend/controllers/batchController.js

---

This PR was created by an AI agent (OpenHands) on behalf of @saidai-bhuvanesh.

[vercel]

@openhands-agent is attempting to deploy a commit to the Nitya Gosain's projects Team on Vercel.

A member of the Team first needs to authorize it.