fix: harden DingTalk student synchronization

apps/server/src/sync/sync.controller.spec.ts

@@ -1,3 +1,4 @@
+import { BadRequestException } from '@nestjs/common';
 import { SyncController } from './sync.controller';
 import { ScheduleSyncQueryDto } from './dto/schedule-sync.dto';
 
@@ -20,4 +21,26 @@ describe('SyncController — schedule sync options', () => {
       true,
     );
   });
+
+  it.each(['1abc', '0', '-1', '9007199254740992'])(
+    'rejects invalid root department id %s',
+    async (rootDeptId) => {
+      const syncService = { triggerSync: jest.fn() };
+      const controller = new SyncController(syncService as never);
+
+      await expect(controller.triggerSync('dingtalk_students', rootDeptId)).rejects.toBeInstanceOf(
+        BadRequestException,
+      );
+      expect(syncService.triggerSync).not.toHaveBeenCalled();
+    },
+  );
+
+  it('accepts a positive integer root department id', async () => {
+    const syncService = { triggerSync: jest.fn().mockResolvedValue([]) };
+    const controller = new SyncController(syncService as never);
+
+    await controller.triggerSync('dingtalk_students', '12');
+
+    expect(syncService.triggerSync).toHaveBeenCalledWith('dingtalk_students', 12);
+  });
 });