[Bug]POST /v1/devices API Fails to Reject SN Codes Containing Chinese Characters

[Unmeiwa]

Description

When sending a serial number (SN) containing Chinese characters through the API to the server, the system does not perform effective validation or restrictions, allowing unexpected character sets to be accepted.

Steps to Reproduce

Steps to reproduce the behavior:
1.Open an API testing tool (e.g., Postman).
2.Construct a request body with a SN code containing Chinese characters, for example: "sn": "SN202501是2002".
3.Send a POST request to the specified API endpoint.

Actual Behavior

The server accepts the SN code containing Chinese characters and successfully creates the device record.

Expected Behavior

The system should reject SN codes containing non-alphanumeric characters, or at least specify the supported character set in the API documentation.

Environment (if applicable)

• OS:Windows11
• Browser / Tool:Chrome/Postman
• SDK / Client:
• Other relevant details:https://api.stayforge.net/v1/devices/org_4e8fb2461d71963a/ten_0a9ac5ef99e74ee4

Additional Context

The screenshot shows that the SN code containing Chinese characters was successfully accepted.
The API documentation does not specify any restrictions on the character set for the SN code.

[Unmeiwa]

[Iktahana]

Issue Verification: CONFIRMED ✓

The bug is real. The POST /v1/devices endpoint does not validate the SN code format. Looking at the codebase:

Location: /internal/handlers/devices/devices.go (lines 385-402)

Current behavior:

• Only checks if SN is nil or empty
• No pattern validation for character set
• OpenAPI schema has no pattern or format defined for sn field

Root cause: Missing input validation on the SN field. The device_id field correctly uses pattern ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ but sn has no equivalent validation.

Recommendation: Add pattern validation to reject non-ASCII characters or clearly document supported character set in API documentation.