[SEC-A05]: Validación Zod en endpoints mutables

src/modules/admin/banners/admin-banners.routes.js

@@ -2,6 +2,13 @@ import { Router } from "express";
 import authenticate from "../../../config/jwt.config.js";
 import { requireRole } from "../../../middlewares/auth.middleware.js";
 import { parsePagination } from "../../../middlewares/pagination.middleware.js";
+import { validate } from "../../../middlewares/validate.middleware.js";
+import { IdParamDTO } from "../../../modules/global/dtos/base/base.param.dto.js";
+import {
+  AdminCreateBannerDTO,
+  AdminUpdateBannerDTO,
+  AdminToggleBannerActiveDTO
+} from "../../../modules/global/dtos/banners/admin-banner.dto.js";
 import { ROLES } from "../../../constants/roles.constant.js";
 import {
   createAdminBanner,
@@ -40,7 +47,7 @@ const router = Router();
  *       403:
  *         description: Sin permisos de administrador
  */
-router.post("/", authenticate, requireRole(ROLES.ADMIN), createAdminBanner);
+router.post("/", authenticate, requireRole(ROLES.ADMIN), validate(AdminCreateBannerDTO, "body"), createAdminBanner);
 
 /**
  * @swagger
@@ -123,7 +130,7 @@ router.get("/", authenticate, requireRole(ROLES.ADMIN), parsePagination, getAdmi
  *       404:
  *         description: Banner no encontrado
  */
-router.put("/:id", authenticate, requireRole(ROLES.ADMIN), updateAdminBanner);
+router.put("/:id", authenticate, requireRole(ROLES.ADMIN), validate(IdParamDTO, "params"), validate(AdminUpdateBannerDTO, "body"), updateAdminBanner);
 
 /**
  * @swagger
@@ -161,6 +168,6 @@ router.put("/:id", authenticate, requireRole(ROLES.ADMIN), updateAdminBanner);
  *       404:
  *         description: Banner no encontrado
  */
-router.patch("/:id/active", authenticate, requireRole(ROLES.ADMIN), toggleAdminBannerActive);
+router.patch("/:id/active", authenticate, requireRole(ROLES.ADMIN), validate(IdParamDTO, "params"), validate(AdminToggleBannerActiveDTO, "body"), toggleAdminBannerActive);
 
 export { router as adminBannersRoutes };

src/modules/admin/categories/admin-category.routes.js

@@ -1,6 +1,13 @@
 import { Router } from "express";
 import authenticate from "../../../config/jwt.config.js";
 import { requireRole } from "../../../middlewares/auth.middleware.js";
+import { validate } from "../../../middlewares/validate.middleware.js";
+import { IdParamDTO } from "../../../modules/global/dtos/base/base.param.dto.js";
+import {
+  AdminCreateCategoryDTO,
+  AdminUpdateCategoryDTO,
+  AdminCategoryDecisionDTO
+} from "../../../modules/global/dtos/product-categories/admin-category.dto.js";
 import {
   createAdminProductCategory,
   getAdminProductCategory,
@@ -42,7 +49,7 @@ const router = Router();
  *       403:
  *         description: Sin permisos de administrador
  */
-router.post("/", authenticate, requireRole(ROLES.ADMIN), createAdminProductCategory);
+router.post("/", authenticate, requireRole(ROLES.ADMIN), validate(AdminCreateCategoryDTO, "body"), createAdminProductCategory);
 
 /**
  * @swagger
@@ -205,7 +212,7 @@ router.get(
  *       404:
  *         description: Solicitud de categoría no encontrada
  */
-router.patch("/:id", authenticate, requireRole(ROLES.ADMIN), processAdminCategoryRequest);
+router.patch("/:id", authenticate, requireRole(ROLES.ADMIN), validate(IdParamDTO, "params"), validate(AdminCategoryDecisionDTO, "body"), processAdminCategoryRequest);
 
 /**
  * @swagger
@@ -246,7 +253,7 @@ router.patch("/:id", authenticate, requireRole(ROLES.ADMIN), processAdminCategor
  *       404:
  *         description: Categoría no encontrada
  */
-router.put("/:id", authenticate, requireRole(ROLES.ADMIN), updateAdminProductCategory);
+router.put("/:id", authenticate, requireRole(ROLES.ADMIN), validate(IdParamDTO, "params"), validate(AdminUpdateCategoryDTO, "body"), updateAdminProductCategory);
 
 /**
  * @swagger
@@ -270,6 +277,6 @@ router.put("/:id", authenticate, requireRole(ROLES.ADMIN), updateAdminProductCat
  *       404:
  *         description: Categoría no encontrada
  */
-router.delete("/:id", authenticate, requireRole(ROLES.ADMIN), deleteAdminProductCategory);
+router.delete("/:id", authenticate, requireRole(ROLES.ADMIN), validate(IdParamDTO, "params"), deleteAdminProductCategory);
 
 export { router as adminCategoryRoutes };

src/modules/admin/products/admin-products.routes.js

@@ -3,6 +3,9 @@ import authenticate from "../../../config/jwt.config.js";
 import { requireRole } from "../../../middlewares/auth.middleware.js";
 import { parsePagination } from "../../../middlewares/pagination.middleware.js";
 import { ROLES } from "../../../constants/roles.constant.js";
+import { validate } from "../../../middlewares/validate.middleware.js";
+import { IdParamDTO } from "../../../modules/global/dtos/base/base.param.dto.js";
+import { AdminUpdateProductStatusDTO } from "../../../modules/global/dtos/products/admin-product.dto.js";
 import { getProducts, updateProductStatus } from "./admin-products.controller.js";
 
 const router = Router();
@@ -11,6 +14,6 @@ const router = Router();
 router.get("/", authenticate, requireRole(ROLES.ADMIN), parsePagination, getProducts);
 
 // PATCH /api/admin/products/:id/status — body: { status: "ACTIVE"|"REJECTED", reason? }
-router.patch("/:id/status", authenticate, requireRole(ROLES.ADMIN), updateProductStatus);
+router.patch("/:id/status", authenticate, requireRole(ROLES.ADMIN), validate(IdParamDTO, "params"), validate(AdminUpdateProductStatusDTO, "body"), updateProductStatus);
 
 export { router as adminProductsRoutes };

src/modules/admin/stores/admin-stores.routes.js

@@ -2,6 +2,9 @@ import { Router } from "express";
 import authenticate from "../../../config/jwt.config.js";
 import { requireRole } from "../../../middlewares/auth.middleware.js";
 import { parsePagination } from "../../../middlewares/pagination.middleware.js";
+import { validate } from "../../../middlewares/validate.middleware.js";
+import { IdParamDTO } from "../../../modules/global/dtos/base/base.param.dto.js";
+import { AdminRejectStoreDTO } from "../../../modules/global/dtos/commerce/admin-store.dto.js";
 import { approveStore, getPendingStores, rejectStore } from "./admin-stores.controller.js";
 import { ROLES } from "../../../constants/roles.constant.js";
 
@@ -11,9 +14,9 @@ const router = Router();
 router.get("/pending", authenticate, requireRole(ROLES.ADMIN), parsePagination, getPendingStores);
 
 // PATCH /api/admin/stores/:id/approve — aprobar un comercio
-router.patch("/:id/approve", authenticate, requireRole(ROLES.ADMIN), approveStore);
+router.patch("/:id/approve", authenticate, requireRole(ROLES.ADMIN), validate(IdParamDTO, "params"), approveStore);
 
 // PATCH /api/admin/stores/:id/reject — rechaza un comercio
-router.patch("/:id/reject", authenticate, requireRole(ROLES.ADMIN), rejectStore);
+router.patch("/:id/reject", authenticate, requireRole(ROLES.ADMIN), validate(IdParamDTO, "params"), validate(AdminRejectStoreDTO, "body"), rejectStore);
 
 export { router as adminStoresRoutes };

src/modules/admin/tags/admin-tag.routes.js

@@ -1,6 +1,12 @@
 import { Router } from "express";
 import authenticate from "../../../config/jwt.config.js";
 import { requireRole } from "../../../middlewares/auth.middleware.js";
+import { validate } from "../../../middlewares/validate.middleware.js";
+import { IdParamDTO } from "../../../modules/global/dtos/base/base.param.dto.js";
+import {
+  AdminCreateTagDTO,
+  AdminUpdateTagDTO
+} from "../../../modules/global/dtos/product-tags/admin-tag.dto.js";
 import {
   createAdminTag,
   getAdminTags,
@@ -56,7 +62,7 @@ const router = Router();
  *       403:
  *         description: Sin permisos de administrador
  */
-router.post("/", authenticate, requireRole(ROLES.ADMIN), createAdminTag);
+router.post("/", authenticate, requireRole(ROLES.ADMIN), validate(AdminCreateTagDTO, "body"), createAdminTag);
 
 /**
  * @swagger
@@ -153,7 +159,7 @@ router.get("/", authenticate, requireRole(ROLES.ADMIN), getAdminTags);
  *       404:
  *         description: Etiqueta no encontrada
  */
-router.patch("/:id", authenticate, requireRole(ROLES.ADMIN), updateAdminTag);
+router.patch("/:id", authenticate, requireRole(ROLES.ADMIN), validate(IdParamDTO, "params"), validate(AdminUpdateTagDTO, "body"), updateAdminTag);
 
 /**
  * @swagger
@@ -181,6 +187,6 @@ router.patch("/:id", authenticate, requireRole(ROLES.ADMIN), updateAdminTag);
  *       404:
  *         description: Etiqueta no encontrada
  */
-router.delete("/:id", authenticate, requireRole(ROLES.ADMIN), deleteAdminTag);
+router.delete("/:id", authenticate, requireRole(ROLES.ADMIN), validate(IdParamDTO, "params"), deleteAdminTag);
 
 export { router as adminTagRoutes };

src/modules/commerce/addresses/routes/addresses.routes.js

@@ -1,24 +1,27 @@
 import { Router } from "express";
 import authenticate from "../../../../config/jwt.config.js";
+import { validate } from "../../../../middlewares/validate.middleware.js";
 import {
     createStoreAddress,
     deleteStoreAddress,
     getStoreAddressById,
     getStoreAddresses,
     updateStoreAddress,
 } from "../controllers/addresses.controllers.js";
+import { IdParamDTO, AddressIdParamDTO } from "../../../global/dtos/common/params.dto.js";
+import { CreateAddressDTO, UpdateAddressDTO } from "../../../global/dtos/addresses/address.dto.js";
 
 const router = Router();
 
 // crea una nueva direccion para el comercio
-router.post("/:id/addresses", authenticate, createStoreAddress);
+router.post("/:id/addresses", authenticate, validate(IdParamDTO, "params"), validate(CreateAddressDTO, "body"), createStoreAddress);
 // lista las direcciones activas del comercio
 router.get("/:id/addresses", authenticate, getStoreAddresses);
 // obtiene una direccion puntual del comercio
 router.get("/:id/addresses/:id_address", authenticate, getStoreAddressById);
 // edita una direccion puntual del comercio
-router.put("/:id/addresses/:id_address", authenticate, updateStoreAddress);
+router.put("/:id/addresses/:id_address", authenticate, validate(IdParamDTO, "params"), validate(AddressIdParamDTO, "params"), validate(UpdateAddressDTO, "body"), updateStoreAddress);
 // desactiva una direccion puntual del comercio
-router.delete("/:id/addresses/:id_address", authenticate, deleteStoreAddress);
+router.delete("/:id/addresses/:id_address", authenticate, validate(IdParamDTO, "params"), validate(AddressIdParamDTO, "params"), deleteStoreAddress);
 
 export default router;

src/modules/commerce/business-hours/routes/business-hours.routes.js

@@ -1,13 +1,16 @@
 import { Router } from "express";
 import authenticate from "../../../../config/jwt.config.js";
+import { validate } from "../../../../middlewares/validate.middleware.js";
 import {
   getStoreBusinessHours,
   updateStoreBusinessHours,
 } from "../controllers/business-hours.controllers.js";
+import { IdParamDTO } from "../../../global/dtos/common/params.dto.js";
+import { UpdateBusinessHoursDTO } from "../../../global/dtos/business-hours/business-hours.dto.js";
 
 const router = Router();
 
 router.get("/:id/business-hours", getStoreBusinessHours);
-router.put("/:id/business-hours", authenticate, updateStoreBusinessHours);
+router.put("/:id/business-hours", authenticate, validate(IdParamDTO, "params"), validate(UpdateBusinessHoursDTO, "body"), updateStoreBusinessHours);
 
 export default router;

src/modules/commerce/category-requests/category-request.routes.js

@@ -1,8 +1,10 @@
 import { Router } from "express";
 import authenticate from "../../../config/jwt.config.js";
 import { requireRole } from "../../../middlewares/auth.middleware.js";
+import { validate } from "../../../middlewares/validate.middleware.js";
 import { createCategoryRequest } from "./category-request.controller.js";
 import { ROLES } from "../../../constants/roles.constant.js";
+import { CreateCategoryRequestDTO } from "../../global/dtos/category-requests/category-request.dto.js";
 
 const router = Router();
 
@@ -50,6 +52,7 @@ router.post(
   "/",
   authenticate,
   requireRole(ROLES.SELLER),
+  validate(CreateCategoryRequestDTO, "body"),
   createCategoryRequest
 );
 

src/modules/commerce/commerces/store.routes.js

@@ -14,6 +14,8 @@ import {
 } from "./store.controller.js";
 import { parsePagination } from "../../../middlewares/pagination.middleware.js";
 import { validate } from "../../../middlewares/validate.middleware.js";
+import { CreateStoreDTO, UpdateStoreDTO, UpdateStoreStatusDTO } from "../../global/dtos/commerce/store.request.dto.js";
+import { IdParamDTO } from "../../global/dtos/common/params.dto.js";
 import { FilterStoreProductsDTO } from "../../global/dtos/commerce/filter-store-products.dto.js";
 import { getStoreDashboard } from "./store-dashboard.controller.js";
 
@@ -59,7 +61,7 @@ const router = Router();
  *             schema:
  *               $ref: '#/components/schemas/ErrorResponse'
  */
-router.post("/", authenticate, createStore);
+router.post("/", authenticate, validate(CreateStoreDTO, "body"), createStore);
 
 /**
  * @swagger
@@ -123,7 +125,7 @@ router.post("/", authenticate, createStore);
  *             schema:
  *               $ref: '#/components/schemas/ErrorResponse'
  */
-router.put("/:id", authenticate, updateStore);
+router.put("/:id", authenticate, validate(IdParamDTO, "params"), validate(UpdateStoreDTO, "body"), updateStore);
 
 /**
  * @swagger
@@ -315,7 +317,7 @@ router.get(
 );
 
 // PATCH /api/commerces/:id/status — habilitar/deshabilitar comercio
-router.patch("/:id/status", authenticate, updateStoreStatus);
+router.patch("/:id/status", authenticate, validate(IdParamDTO, "params"), validate(UpdateStoreStatusDTO, "body"), updateStoreStatus);
 
 /**
  * @swagger
@@ -360,7 +362,7 @@ router.patch("/:id/status", authenticate, updateStoreStatus);
  *             schema:
  *               $ref: '#/components/schemas/ErrorResponse'
  */
-router.delete("/:id", deleteStore);
+router.delete("/:id", validate(IdParamDTO, "params"), deleteStore);
 
 // Dashboard del comercio — autenticado, solo el dueño
 router.get("/:id/dashboard", authenticate, getStoreDashboard);

src/modules/commerce/deliveries/delivery.routes.js

@@ -2,13 +2,16 @@ import { Router } from "express";
 import authenticate from "../../../config/jwt.config.js";
 import { requireRole } from "../../../middlewares/auth.middleware.js";
 import { ROLES } from "../../../constants/roles.constant.js";
+import { validate } from "../../../middlewares/validate.middleware.js";
 import {
   searchDeliveries,
   createDelivery,
   getStoreDeliveries,
   deleteStoreDelivery,
   getStoreDeliveryReviews,
 } from "./delivery.controller.js";
+import { IdParamDTO, DeliveryIdParamDTO } from "../../global/dtos/common/params.dto.js";
+import { CreateStoreDeliveryDTO } from "../../global/dtos/commerce-deliveries/commerce-deliveries.dto.js";
 
 export const deliveryRouter = Router();
 export const storeDeliveryRouter = Router();
@@ -115,7 +118,7 @@ deliveryRouter.get("/search", authenticate, requireRole(ROLES.SELLER), searchDel
  *       409:
  *         description: El repartidor ya está vinculado a un comercio
  */
-storeDeliveryRouter.post("/:id/deliveries", authenticate, requireRole(ROLES.SELLER), createDelivery);
+storeDeliveryRouter.post("/:id/deliveries", authenticate, requireRole(ROLES.SELLER), validate(IdParamDTO, "params"), validate(CreateStoreDeliveryDTO, "body"), createDelivery);
 
 /**
  * @swagger
@@ -238,7 +241,7 @@ storeDeliveryRouter.get("/:id/deliveries", authenticate, requireRole(ROLES.SELLE
  *       404:
  *         description: Delivery no encontrado para este comercio
  */
-storeDeliveryRouter.delete("/:id/deliveries/:deliveryId", authenticate, requireRole(ROLES.SELLER), deleteStoreDelivery);
+storeDeliveryRouter.delete("/:id/deliveries/:deliveryId", authenticate, requireRole(ROLES.SELLER), validate(IdParamDTO, "params"), validate(DeliveryIdParamDTO, "params"), deleteStoreDelivery);
 
 /**
  * @swagger

src/modules/commerce/products/product.routes.js

@@ -12,7 +12,8 @@ import {
   getRelatedProducts
 } from "./product.controller.js";
 import { validate } from "../../../middlewares/validate.middleware.js";
-import { FilterProductDTO } from "../../global/dtos/products/product.request.dto.js";
+import { CreateProductDTO, UpdateProductDTO, FilterProductDTO } from "../../global/dtos/products/product.request.dto.js";
+import { IdParamDTO } from "../../global/dtos/common/params.dto.js";
 import { parsePagination } from "../../../middlewares/pagination.middleware.js";
 
 const router = Router();
@@ -57,7 +58,7 @@ const router = Router();
  *             schema:
  *               $ref: '#/components/schemas/ErrorResponse'
  */
-router.post("/", authenticate, createProduct);
+router.post("/", authenticate, validate(CreateProductDTO, "body"), createProduct);
 
 /**
  * @swagger
@@ -112,7 +113,7 @@ router.post("/", authenticate, createProduct);
  *             schema:
  *               $ref: '#/components/schemas/ErrorResponse'
  */
-router.put("/:id", authenticate, updateProduct);
+router.put("/:id", authenticate, validate(IdParamDTO, "params"), validate(UpdateProductDTO, "body"), updateProduct);
 
 /**
  * @swagger
@@ -151,7 +152,7 @@ router.put("/:id", authenticate, updateProduct);
  *             schema:
  *               $ref: '#/components/schemas/ErrorResponse'
  */
-router.delete("/:id", authenticate, deleteProduct);
+router.delete("/:id", authenticate, validate(IdParamDTO, "params"), deleteProduct);
 
 /**
  * @swagger

src/modules/delivery/delivery-assignments/delivery-assignments.routes.js

@@ -16,6 +16,9 @@ import {
   getDeliveryOrderHistory,
 } from "./delivery-assignments.controller.js";
 import { parsePagination } from "../../../middlewares/pagination.middleware.js";
+import { validate } from "../../../middlewares/validate.middleware.js";
+import { IdParamDTO, OrderIdParamDTO } from "../../global/dtos/common/params.dto.js";
+import { CreateAssignmentDTO, RespondToAssignmentDTO } from "../../global/dtos/delivery-assignments/delivery-assignments.dto.js";
 
 const router = Router();
 
@@ -143,7 +146,7 @@ const router = Router();
  *                       type: string
  *                       example: "Ya hay una asignación pendiente para este pedido"
  */
-router.post("/", authenticate, requireRole(ROLES.SELLER), createAssignment);
+router.post("/", authenticate, requireRole(ROLES.SELLER), validate(CreateAssignmentDTO, "body"), createAssignment);
 
 /**
  * @swagger
@@ -564,7 +567,7 @@ router.get("/orders/:orderId/accepted", authenticate, getAcceptedAssignment);
  *                       type: string
  *                       example: "Solo se pueden completar asignaciones aceptadas"
  */
-router.post("/:id/complete", authenticate, requireRole(ROLES.DELIVERY), completeAssignment);
+router.post("/:id/complete", authenticate, requireRole(ROLES.DELIVERY), validate(IdParamDTO, "params"), completeAssignment);
 
 /**
  * @swagger
@@ -622,7 +625,7 @@ router.post("/:id/complete", authenticate, requireRole(ROLES.DELIVERY), complete
  *                 - $ref: '#/components/schemas/DeliveryResponseNotFound'
  *                 - $ref: '#/components/schemas/DeliveryResponseNoAvailable'
  */
-router.post("/orders/:orderId/delivery-response", authenticate, requireRole(ROLES.DELIVERY), respondToAssignment);
+router.post("/orders/:orderId/delivery-response", authenticate, requireRole(ROLES.DELIVERY), validate(OrderIdParamDTO, "params"), validate(RespondToAssignmentDTO, "body"), respondToAssignment);
 
 /**
  * @swagger