feat: validate expand api parameter

pkg/models/error.go

@@ -111,11 +111,15 @@ func (err ValidationHTTPError) Error() string {
 }
 
 func InvalidFieldError(fields []string) error {
+	return InvalidFieldErrorWithMessage(fields, "Invalid Data")
+}
+
+func InvalidFieldErrorWithMessage(fields []string, message string) error {
 	return ValidationHTTPError{
 		HTTPError: web.HTTPError{
 			HTTPCode: http.StatusPreconditionFailed,
 			Code:     ErrCodeInvalidData,
-			Message:  "Invalid Data",
+			Message:  message,
 		},
 		InvalidFields: fields,
 	}

pkg/models/task_collection.go

@@ -64,6 +64,16 @@ type TaskCollectionExpandable string
 
 const TaskCollectionExpandSubtasks TaskCollectionExpandable = `subtasks`
 
+// Validate validates if the TaskCollectionExpandable value is valid.
+func (t TaskCollectionExpandable) Validate() error {
+	switch t {
+	case TaskCollectionExpandSubtasks:
+		return nil
+	}
+
+	return InvalidFieldErrorWithMessage([]string{"expand"}, "Expand must be one of the following values: subtasks")
+}
+
 func validateTaskField(fieldName string) error {
 	switch fieldName {
 	case
@@ -331,6 +341,11 @@ func (tf *TaskCollection) ReadAll(s *xorm.Session, a web.Auth, search string, pa
 		return nil, 0, 0, err
 	}
 
+	err = tf.Expand.Validate()
+	if err != nil {
+		return nil, 0, 0, err
+	}
+
 	opts.search = search
 	opts.page = page
 	opts.perPage = perPage