From 235b4aadfec6d961043ea916bfe93e53e5294109 Mon Sep 17 00:00:00 2001
From: Brian Krabach <brkrabac@microsoft.com>
Date: Wed, 1 Apr 2026 14:38:09 -0700
Subject: [PATCH] fix: guard negative remote_id in federation_connect endpoint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Negative Python list indices bypass the intended 404 guard — e.g.
remote_id=-1 on a non-empty list silently proxied to the last remote
instead of returning 404.

Add an explicit 'idx < 0' check before the list lookup, consistent
with the sibling federation_terminal_ws_proxy endpoint (line 728).

Also adds test_federation_connect_returns_404_for_negative_remote_id
to document the expected behavior and prevent regression.
---
 muxplex/main.py           |  2 ++
 muxplex/tests/test_api.py | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/muxplex/main.py b/muxplex/main.py
index 95a5c3b..6199738 100644
--- a/muxplex/main.py
+++ b/muxplex/main.py
@@ -1008,6 +1008,8 @@ async def federation_connect(
     remotes = settings.get("remote_instances", [])
     try:
         idx = int(remote_id)
+        if idx < 0 or idx >= len(remotes):
+            raise IndexError
         remote = remotes[idx]
     except (ValueError, IndexError):
         raise HTTPException(
diff --git a/muxplex/tests/test_api.py b/muxplex/tests/test_api.py
index 9835ae8..d148709 100644
--- a/muxplex/tests/test_api.py
+++ b/muxplex/tests/test_api.py
@@ -1915,6 +1915,42 @@ def test_federation_connect_returns_502_when_remote_returns_error_status(
     assert response.status_code == 502
 
 
+def test_federation_connect_returns_404_for_negative_remote_id(
+    client, monkeypatch, tmp_path
+):
+    """POST /api/federation/{remote_id}/connect/{session_name} returns 404 for negative remote_id.
+
+    Negative indices are valid Python list indices ("from the end"), so without an
+    explicit guard a value like -1 would silently proxy to the last configured remote
+    instead of returning 404.  The endpoint must treat negatives as out-of-range.
+    """
+    import json
+
+    import muxplex.settings as settings_mod
+
+    settings_path = tmp_path / "settings.json"
+    monkeypatch.setattr(settings_mod, "SETTINGS_PATH", settings_path)
+
+    # One remote configured — without the guard, remote_id=-1 would return it
+    settings_path.write_text(
+        json.dumps(
+            {
+                "remote_instances": [
+                    {
+                        "url": "http://remote-host:8088",
+                        "key": "secret-key-123",
+                        "name": "remote-host",
+                        "id": "remote-0",
+                    }
+                ],
+            }
+        )
+    )
+
+    response = client.post("/api/federation/-1/connect/my-session")
+    assert response.status_code == 404
+
+
 # ---------------------------------------------------------------------------
 # POST /api/federation/generate-key (task-13)
 # ---------------------------------------------------------------------------