Skip to content

fix(guardrails): use validateBody() in /api/guardrails/test route #3621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
diegosouzapw merged 1 commit into from
Jun 11, 2026
+10 −7
Merged

fix(guardrails): use validateBody() in /api/guardrails/test route #3621

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 10 additions & 7 deletions src/app/api/guardrails/test/route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ import { CORS_HEADERS, handleCorsOptions } from "@/shared/utils/cors";
import { createErrorResponse } from "@/lib/api/errorResponse";
import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
import { registerDefaultGuardrails } from "@/lib/guardrails/registry";
import { validateBody, isValidationFailure } from "@/shared/validation/helpers";

const TestRequestSchema = z.object({
input: z.union([z.string(), z.record(z.unknown()), z.array(z.unknown())]),
Expand All @@ -28,17 +29,19 @@ export async function POST(request: NextRequest) {
const authError = await requireManagementAuth(request);
if (authError) return authError;

let parsed: z.infer<typeof TestRequestSchema>;
let rawBody: unknown;
try {
parsed = TestRequestSchema.parse(await request.json());
rawBody = await request.json();
} catch {
return createErrorResponse({
status: 400,
message: "Invalid request body — expected { input: string | object | array, disabledGuardrails?: string[] }",
type: "invalid_request",
});
return createErrorResponse({ status: 400, message: "Invalid JSON body", type: "invalid_request" });

@kilo-code-bot kilo-code-bot Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WARNING: Error message for invalid JSON changed from the schema description to a short "Invalid JSON body" string

Previously, the single catch block returned the same message for both invalid JSON and schema validation failures. After this refactor, invalid JSON now returns "Invalid JSON body" while schema validation still returns the detailed "Invalid request body — expected { input: string | object | array, disabledGuardrails?: string[] }" message. This behavioral change could break client-side error handling that depends on matching the exact error message string.

If the goal is to keep error messages consistent, consider:

  • Using the same descriptive message for both error paths, OR
  • Exposing a machine-readable discriminator (e.g., error type/code) that clients can depend on instead of the message string.

}

const validation = validateBody(TestRequestSchema, rawBody);
if (isValidationFailure(validation)) {
return createErrorResponse({ status: 400, message: "Invalid request body — expected { input: string | object | array, disabledGuardrails?: string[] }", type: "invalid_request" });
}
Comment on lines +40 to +42

@gemini-code-assist gemini-code-assist Bot Jun 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

When validation fails, the validation object contains detailed error information in validation.error.details. Passing these details to createErrorResponse will provide clients with actionable feedback about which fields failed validation.

  if (isValidationFailure(validation)) {
    return createErrorResponse({
      status: 400,
      message: "Invalid request body — expected { input: string | object | array, disabledGuardrails?: string[] }",
      type: "invalid_request",
      details: validation.error.details,
    });
  }

const parsed = validation.data;

const registry = registerDefaultGuardrails();
const outcome = await registry.runPreCallHooks(parsed.input, {
disabledGuardrails: parsed.disabledGuardrails,
Expand Down