From 2227a286ccbf7548e7caee13b618c1c1630468f9 Mon Sep 17 00:00:00 2001
From: jihadMo <jihadMo@users.noreply.github.com>
Date: Sat, 8 Aug 2026 05:39:28 +0100
Subject: [PATCH] fix(auth): normalize invalid request bodies to HTTP 400
 response (#11394)

---
 .../auth-payload-validation.test.js           | 47 +++++++++++++++++++
 apps/api/src/controllers/authController.js    | 28 ++++++++---
 2 files changed, 68 insertions(+), 7 deletions(-)
 create mode 100644 apps/api/src/controllers/auth-payload-validation.test.js

diff --git a/apps/api/src/controllers/auth-payload-validation.test.js b/apps/api/src/controllers/auth-payload-validation.test.js
new file mode 100644
index 00000000000..107524f6365
--- /dev/null
+++ b/apps/api/src/controllers/auth-payload-validation.test.js
@@ -0,0 +1,47 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { register, login } from "./authController.js";
+
+test("register returns 400 Bad Request for invalid payload", async () => {
+  let statusCode = 0;
+  let responseData = null;
+
+  const req = { body: { email: "not-an-email" } };
+  const res = {
+    status(code) {
+      statusCode = code;
+      return this;
+    },
+    json(data) {
+      responseData = data;
+      return this;
+    },
+  };
+
+  await register(req, res);
+
+  assert.equal(statusCode, 400, "Invalid register payload must return HTTP 400");
+  assert.equal(responseData?.error, "Invalid payload", "Error message must indicate invalid payload");
+});
+
+test("login returns 400 Bad Request for invalid payload", async () => {
+  let statusCode = 0;
+  let responseData = null;
+
+  const req = { body: {} };
+  const res = {
+    status(code) {
+      statusCode = code;
+      return this;
+    },
+    json(data) {
+      responseData = data;
+      return this;
+    },
+  };
+
+  await login(req, res);
+
+  assert.equal(statusCode, 400, "Invalid login payload must return HTTP 400");
+  assert.equal(responseData?.error, "Invalid payload", "Error message must indicate invalid payload");
+});
diff --git a/apps/api/src/controllers/authController.js b/apps/api/src/controllers/authController.js
index 000855c09db..959375e5f15 100644
--- a/apps/api/src/controllers/authController.js
+++ b/apps/api/src/controllers/authController.js
@@ -1,17 +1,31 @@
 import { registerSchema, loginSchema } from "../validators/auth.js";
 import { loginUser, refreshToken, registerUser } from "../services/authService.js";
-import { ok } from "../utils/response.js";
+import { ok, fail } from "../utils/response.js";
 
 export async function register(req, res) {
-  const payload = registerSchema.parse(req.body);
-  const result = await registerUser(payload);
-  return ok(res, result, 201);
+  try {
+    const payload = registerSchema.parse(req.body);
+    const result = await registerUser(payload);
+    return ok(res, result, 201);
+  } catch (err) {
+    if (err?.name === "ZodError" || err?.errors) {
+      return fail(res, "Invalid payload", 400);
+    }
+    throw err;
+  }
 }
 
 export async function login(req, res) {
-  const payload = loginSchema.parse(req.body);
-  const result = await loginUser(payload);
-  return ok(res, result);
+  try {
+    const payload = loginSchema.parse(req.body);
+    const result = await loginUser(payload);
+    return ok(res, result);
+  } catch (err) {
+    if (err?.name === "ZodError" || err?.errors) {
+      return fail(res, "Invalid payload", 400);
+    }
+    throw err;
+  }
 }
 
 export async function oauthCallback(req, res) {