fix(certification): guard bonus_stardust against bad input and slim controller

Author: ObayM

app/controllers/admin/certification/ships_controller.rb

@@ -88,18 +88,10 @@ def set_project_type
 
   def set_bonus_stardust
     authorize @ship
-    value = params[:bonus_stardust].presence
-    @ship.bonus_stardust = value.present? ? value.to_f : nil
-
-    # If the ship already has a verdict, recalculate stardust_earned to
-    # include the updated bonus.
-    if @ship.stardust_earned.present? && !@ship.pending?
-      base = @ship.stardust_earned - (@ship.bonus_stardust_was || 0)
-      @ship.stardust_earned = base + (@ship.bonus_stardust || 0)
-    end
-
-    @ship.save!
+    @ship.update_bonus_stardust!(params[:bonus_stardust].presence)
     redirect_to admin_certification_ship_path(@ship), notice: "Bonus stardust updated."
+  rescue ArgumentError, ActiveRecord::RecordInvalid => e
+    redirect_to admin_certification_ship_path(@ship), alert: "Invalid bonus stardust: #{e.message}"
   end
 
   def update

app/models/certification/ship.rb

@@ -97,6 +97,9 @@ def owner
     validates :feedback, length: { maximum: 10_000 }, allow_blank: true
     validates :verdict_video,
               content_type: { in: ACCEPTED_VIDEO_TYPES, spoofing_protection: true }
+    validates :bonus_stardust,
+              numericality: { greater_than_or_equal_to: 0, less_than_or_equal_to: 100 },
+              allow_nil: true
 
     scope :for_reviewer, ->(user) {
       joins(:project)
@@ -358,6 +361,22 @@ def decided_on
       decided_at || updated_at
     end
 
+    
+    def update_bonus_stardust!(value)
+      self.bonus_stardust = if value.present?
+        parsed = Float(value)
+        raise ArgumentError, "bonus_stardust must be >= 0" if parsed.negative?
+        parsed
+      end
+
+      if stardust_earned.present? && !pending?
+        base = stardust_earned - (bonus_stardust_was || 0)
+        self.stardust_earned = base + (bonus_stardust || 0)
+      end
+
+      save!
+    end
+
     private
 
     def assign_stardust_earned

app/views/admin/certification/ships/show.html.erb

@@ -109,7 +109,7 @@
             <%= form_with url: set_bonus_stardust_admin_certification_ship_path(@ship), method: :patch, class: "bonus-stardust__form" do %>
               <div class="bonus-stardust__field">
                 <%= number_field_tag :bonus_stardust, @ship.bonus_stardust,
-                      step: 0.25, min: 0, placeholder: "0.0",
+                      step: 0.25, min: 0, max: 100, placeholder: "0.0",
                       autocomplete: "off",
                       class: "bonus-stardust__input",
                       id: "bonus-stardust-input" %>