From dead7b9d6bb8bd1c17f28192513e2bda64e583e0 Mon Sep 17 00:00:00 2001
From: Mieszko Makuch <m.makuch@cyfronet.pl>
Date: Thu, 26 Mar 2026 01:56:40 +0100
Subject: [PATCH] =?UTF-8?q?fix(stt):=20address=20review=20feedback=20?=
 =?UTF-8?q?=E2=80=94=20reserved=20fields=20guard,=20schema=20validation,?=
 =?UTF-8?q?=20docs?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Filter reserved fields (file, model, language) from extraParams before merge
- Change extraParams schema to z.record(z.union([z.string(), z.number(), z.boolean()]))
- Add regex validation for language field in Zod schema
- Add JSDoc note about extraParams in openAIProvider
- Add comment clarifying language/extraParams are OpenAI-only (not Azure)
- Remove unnecessary optional chaining on sttSchema
---
 api/server/services/Files/Audio/STTService.js | 10 +++++++---
 packages/data-provider/src/config.ts          |  8 ++++++--
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/api/server/services/Files/Audio/STTService.js b/api/server/services/Files/Audio/STTService.js
index 3a7a51bd8d..abd9c2272b 100644
--- a/api/server/services/Files/Audio/STTService.js
+++ b/api/server/services/Files/Audio/STTService.js
@@ -186,7 +186,7 @@ class STTService {
 
   /**
    * Prepares the request for the OpenAI STT provider.
-   * @param {Object} sttSchema - The STT schema for OpenAI.
+   * @param {Object} sttSchema - The STT schema for OpenAI (includes optional language and extraParams).
    * @param {Stream} audioReadStream - The audio data to be transcribed.
    * @param {Object} audioFile - The audio file object (unused in OpenAI provider).
    * @param {string} language - The language code for the transcription.
@@ -206,8 +206,12 @@ class STTService {
       data.language = validLanguage;
     }
 
-    if (sttSchema?.extraParams) {
-      Object.assign(data, sttSchema.extraParams);
+    if (sttSchema.extraParams) {
+      const reservedFields = new Set(['file', 'model', 'language']);
+      const safeParams = Object.fromEntries(
+        Object.entries(sttSchema.extraParams).filter(([key]) => !reservedFields.has(key)),
+      );
+      Object.assign(data, safeParams);
     }
 
     const headers = {
diff --git a/packages/data-provider/src/config.ts b/packages/data-provider/src/config.ts
index fb89c7c486..7ba0c99249 100644
--- a/packages/data-provider/src/config.ts
+++ b/packages/data-provider/src/config.ts
@@ -478,10 +478,14 @@ const sttOpenaiSchema = z.object({
   url: z.string().optional(),
   apiKey: z.string(),
   model: z.string(),
-  language: z.string().optional(),
-  extraParams: z.record(z.unknown()).optional(),
+  language: z
+    .string()
+    .regex(/^[a-z]{2}(-[a-z]{2})?$/)
+    .optional(),
+  extraParams: z.record(z.union([z.string(), z.number(), z.boolean()])).optional(),
 });
 
+/** Note: language and extraParams are only supported for the OpenAI provider. */
 const sttAzureOpenAISchema = z.object({
   instanceName: z.string(),
   apiKey: z.string(),