From 9972f22aef88b5ac182100cba3ce87094dce86f1 Mon Sep 17 00:00:00 2001
From: Eleazar Resendez <eleazar.resendez@processmaker.com>
Date: Wed, 26 Aug 2026 08:10:16 -0600
Subject: [PATCH] fix(process-browser): handle invalid category IDs

---
 .../Api/ProcessLaunchpadController.php        |  9 +++-
 tests/Feature/Api/ProcessLaunchpadTest.php    | 50 +++++++++++++++++++
 2 files changed, 57 insertions(+), 2 deletions(-)

diff --git a/ProcessMaker/Http/Controllers/Api/ProcessLaunchpadController.php b/ProcessMaker/Http/Controllers/Api/ProcessLaunchpadController.php
index 72d62ccc95..7b5485c3e1 100644
--- a/ProcessMaker/Http/Controllers/Api/ProcessLaunchpadController.php
+++ b/ProcessMaker/Http/Controllers/Api/ProcessLaunchpadController.php
@@ -28,8 +28,13 @@ public function getProcesses(Request $request)
         $category = $request->input('category', null);
         if ($category === 'recent') {
             $processes->orderByRecentRequests();
-        } elseif (!empty($category)) {
-            $processes->processCategory($category);
+        } elseif ($category !== null && $category !== '') {
+            $categoryId = filter_var($category, FILTER_VALIDATE_INT);
+            if ($categoryId === false) {
+                $processes->whereRaw('1 = 0');
+            } else {
+                $processes->processCategory($categoryId);
+            }
         }
         // Filter pmql
         $pmql = $request->input('pmql', '');
diff --git a/tests/Feature/Api/ProcessLaunchpadTest.php b/tests/Feature/Api/ProcessLaunchpadTest.php
index 0f25819361..fd619ae286 100644
--- a/tests/Feature/Api/ProcessLaunchpadTest.php
+++ b/tests/Feature/Api/ProcessLaunchpadTest.php
@@ -5,6 +5,7 @@
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Auth;
 use ProcessMaker\Models\Process;
+use ProcessMaker\Models\ProcessCategory;
 use ProcessMaker\Models\ProcessLaunchpad;
 use ProcessMaker\Models\ProcessRequest;
 use Tests\Feature\Shared\RequestHelper;
@@ -16,6 +17,8 @@ class ProcessLaunchpadTest extends TestCase
 
     const API_TEST_URL = '/process_launchpad';
 
+    const PROCESSES_API_TEST_URL = '/process_bookmarks/processes';
+
     const STRUCTURE = [
         'launchpad',
         'media',
@@ -49,6 +52,53 @@ public function testGetProcessLaunchpad()
         $this->assertNotEmpty($response);
     }
 
+    public function testGetProcessesReturnsEmptyCollectionForNonNumericCategory()
+    {
+        Process::factory()->create();
+
+        $response = $this->apiCall('GET', self::PROCESSES_API_TEST_URL, [
+            'category' => 'lorem',
+        ]);
+
+        $response->assertOk()
+            ->assertJsonCount(0, 'data')
+            ->assertJsonPath('meta.total', 0);
+    }
+
+    public function testGetProcessesReturnsEmptyCollectionForMissingNumericCategory()
+    {
+        Process::factory()->create();
+
+        $response = $this->apiCall('GET', self::PROCESSES_API_TEST_URL, [
+            'category' => '0',
+        ]);
+
+        $response->assertOk()
+            ->assertJsonCount(0, 'data')
+            ->assertJsonPath('meta.total', 0);
+    }
+
+    public function testGetProcessesFiltersByValidCategory()
+    {
+        $category = ProcessCategory::factory()->create();
+        $otherCategory = ProcessCategory::factory()->create();
+        $process = Process::factory()->create([
+            'process_category_id' => $category->id,
+        ]);
+        Process::factory()->create([
+            'process_category_id' => $otherCategory->id,
+        ]);
+
+        $response = $this->apiCall('GET', self::PROCESSES_API_TEST_URL, [
+            'category' => $category->id,
+        ]);
+
+        $response->assertOk()
+            ->assertJsonCount(1, 'data')
+            ->assertJsonPath('data.0.id', $process->id)
+            ->assertJsonPath('meta.total', 1);
+    }
+
     /**
      * Test store process launchpad
      */