Merge pull request #64 from 0xDeon/feat/zod-validation-middleware-20

feat(api): implement runtime zod request validation

Author: codebestia

apps/backend/package.json

@@ -31,7 +31,8 @@
     "jsonwebtoken": "^9.0.3",
     "morgan": "^1.10.1",
     "postgres": "^3.4.9",
-    "socket.io": "^4.8.3"
+    "socket.io": "^4.8.3",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

apps/backend/src/__tests__/validate.test.ts

@@ -0,0 +1,73 @@
+import { describe, it, expect } from 'vitest';
+import express, { type Request, type Response } from 'express';
+import request from 'supertest';
+import { z } from 'zod';
+import { validate } from '../middleware/validate.js';
+
+const TestSchema = z.object({
+  name: z.string().min(1, 'name is required'),
+  age: z.number().int('age must be an integer'),
+});
+
+function makeApp() {
+  const app = express();
+  app.use(express.json());
+  app.post('/test', validate(TestSchema), (req: Request, res: Response) => {
+    res.json({ received: req.body });
+  });
+  return app;
+}
+
+describe('validate middleware', () => {
+  const app = makeApp();
+
+  it('calls next and passes body through on valid input', async () => {
+    const res = await request(app).post('/test').send({ name: 'Alice', age: 30 });
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ received: { name: 'Alice', age: 30 } });
+  });
+
+  it('returns 400 with structured error on missing required field', async () => {
+    const res = await request(app).post('/test').send({ age: 25 });
+    expect(res.status).toBe(400);
+    expect(res.body.error).toBe('Validation failed');
+    expect(Array.isArray(res.body.issues)).toBe(true);
+    const fields = res.body.issues.map((i: { field: string }) => i.field);
+    expect(fields).toContain('name');
+  });
+
+  it('returns 400 with structured error on wrong type', async () => {
+    const res = await request(app).post('/test').send({ name: 'Bob', age: 'not-a-number' });
+    expect(res.status).toBe(400);
+    expect(res.body.error).toBe('Validation failed');
+    expect(res.body.issues[0]).toHaveProperty('field');
+    expect(res.body.issues[0]).toHaveProperty('message');
+  });
+
+  it('returns 400 with error for empty body', async () => {
+    const res = await request(app).post('/test').send({});
+    expect(res.status).toBe(400);
+    expect(res.body.error).toBe('Validation failed');
+    expect(res.body.issues.length).toBeGreaterThan(0);
+  });
+
+  it('issues array entries have field and message keys', async () => {
+    const res = await request(app).post('/test').send({ age: 10 });
+    expect(res.status).toBe(400);
+    for (const issue of res.body.issues as { field: string; message: string }[]) {
+      expect(issue).toHaveProperty('field');
+      expect(issue).toHaveProperty('message');
+      expect(typeof issue.field).toBe('string');
+      expect(typeof issue.message).toBe('string');
+    }
+  });
+});
+
+describe('auth route validation via validate middleware', () => {
+  it('validate middleware integrates as Express RequestHandler', () => {
+    const handler = validate(TestSchema);
+    expect(typeof handler).toBe('function');
+    // Ensure it accepts (req, res, next) signature
+    expect(handler.length).toBe(3);
+  });
+});

apps/backend/src/middleware/validate.ts

@@ -0,0 +1,20 @@
+import type { Request, Response, NextFunction } from 'express';
+import type { z } from 'zod';
+
+export function validate(schema: z.ZodTypeAny) {
+  return (req: Request, res: Response, next: NextFunction): void => {
+    const result = schema.safeParse(req.body);
+    if (!result.success) {
+      res.status(400).json({
+        error: 'Validation failed',
+        issues: result.error.issues.map((i: z.ZodIssue) => ({
+          field: i.path.join('.') || 'unknown',
+          message: i.message,
+        })),
+      });
+      return;
+    }
+    req.body = result.data as unknown;
+    next();
+  };
+}

apps/backend/src/routes/auth.ts

@@ -1,21 +1,19 @@
 import { Router } from 'express';
+import type { Request, Response, IRouter } from 'express';
 import { Keypair } from '@stellar/stellar-sdk';
 import { db } from '../db/index.js';
 import { users, wallets } from '../db/schema.js';
 import { eq } from 'drizzle-orm';
 import { createNonce, consumeNonce } from '../lib/nonce.js';
 import { signToken } from '../lib/jwt.js';
+import { validate } from '../middleware/validate.js';
+import { ChallengeSchema, VerifySchema, type ChallengeBody, type VerifyBody } from '../schemas/auth.schemas.js';
 
-export const authRouter = Router();
+export const authRouter: IRouter = Router();
 
 // Step 1: client requests a challenge nonce for a wallet address
-authRouter.post('/challenge', (req, res) => {
-  const { walletAddress } = req.body as { walletAddress?: string };
-
-  if (!walletAddress) {
-    res.status(400).json({ error: 'walletAddress is required' });
-    return;
-  }
+authRouter.post('/challenge', validate(ChallengeSchema), (req: Request, res: Response) => {
+  const { walletAddress } = req.body as ChallengeBody;
 
   const nonce = createNonce(walletAddress);
   const message = `Sign in to Clicked\nWallet: ${walletAddress}\nNonce: ${nonce}`;
@@ -24,17 +22,8 @@ authRouter.post('/challenge', (req, res) => {
 });
 
 // Step 2: client signs the message and submits the signature
-authRouter.post('/verify', async (req, res) => {
-  const { walletAddress, signature, nonce } = req.body as {
-    walletAddress?: string;
-    signature?: string;
-    nonce?: string;
-  };
-
-  if (!walletAddress || !signature || !nonce) {
-    res.status(400).json({ error: 'walletAddress, signature, and nonce are required' });
-    return;
-  }
+authRouter.post('/verify', validate(VerifySchema), async (req: Request, res: Response) => {
+  const { walletAddress, signature, nonce } = req.body as VerifyBody;
 
   // Validate and consume nonce
   const valid = consumeNonce(walletAddress, nonce);
@@ -81,4 +70,4 @@ authRouter.post('/verify', async (req, res) => {
 
   const token = signToken({ userId, walletAddress });
   res.json({ token });
-});
+});

apps/backend/src/schemas/auth.schemas.ts

@@ -0,0 +1,14 @@
+import { z } from 'zod';
+
+export const ChallengeSchema = z.object({
+  walletAddress: z.string().min(1, 'walletAddress is required'),
+});
+
+export const VerifySchema = z.object({
+  walletAddress: z.string().min(1, 'walletAddress is required'),
+  signature: z.string().min(1, 'signature is required'),
+  nonce: z.string().min(1, 'nonce is required'),
+});
+
+export type ChallengeBody = z.infer<typeof ChallengeSchema>;
+export type VerifyBody = z.infer<typeof VerifySchema>;