Use zod for validation on create endpoint

common/models/rest-api.ts

@@ -3,6 +3,8 @@ import { ServerMessageEvent } from "./messages";
 import { BehaviorOption, QueueMode, RoomSettings, RoomUserInfo, Visibility } from "./types";
 import { QueueItem, Video, VideoId } from "./video";
 import { Category } from "sponsorblock-api";
+import { createRoomSchema } from "./zod-schemas";
+import { z } from "zod";
 
 export type OttResponseBody<T = unknown, E extends OttApiError = OttApiError> =
 	| OttSuccessResponseBody<T>
@@ -33,12 +35,7 @@ export interface OttApiResponseRoomGenerate {
 }
 
 /** Endpoint: `/api/room/create` */
-export interface OttApiRequestRoomCreate {
-	title?: string;
-	name: string;
-	isTemporary?: boolean;
-	visibility?: Visibility;
-}
+export type OttApiRequestRoomCreate = z.infer<typeof createRoomSchema>;
 
 /** Endpoint: `/api/room/create` */
 export interface OttApiResponseRoomCreate {}

common/models/zod-schemas.ts

@@ -0,0 +1,13 @@
+import { ROOM_NAME_REGEX } from "ott-common/constants";
+import { Visibility } from "ott-common/models/types";
+import { z } from "zod";
+
+export const createRoomSchema = z.object({
+	name: z
+		.string()
+		.min(3, "too short, must be atleast 3 characters")
+		.max(32, "too long, must be at most 32 characters"),
+	title: z.string().max(255, "too long, must be at most 255 characters").optional(),
+	isTemporary: z.boolean().optional(),
+	visibility: z.enum([Visibility.Public, Visibility.Unlisted, Visibility.Private]).optional(),
+});

server/api/room.ts

@@ -32,6 +32,8 @@ import { getApiKey } from "../admin";
 import { v4 as uuidv4 } from "uuid";
 import { counterHttpErrors } from "../metrics";
 import { conf } from "../ott-config";
+import { createRoomSchema } from "ott-common/models/zod-schemas";
+import { ZodError } from "zod";
 
 const router = express.Router();
 const log = getLogger("api/room");
@@ -119,6 +121,8 @@ const createRoom: RequestHandler<
 	OttResponseBody<OttApiResponseRoomCreate>,
 	OttApiRequestRoomCreate
 > = async (req, res) => {
+	const validatedBody = createRoomSchema.parse(req.body);
+
 	function isValidCreateRoom(body: any): body is OttApiRequestRoomCreate {
 		return !!body.name;
 	}
@@ -132,31 +136,9 @@ const createRoom: RequestHandler<
 		throw new FeatureDisabledException("Permanent rooms are disabled.");
 	}
 
-	if (!req.body.name) {
-		throw new BadApiArgumentException("name", "missing");
-	}
 	if (RESERVED_ROOM_NAMES.includes(req.body.name)) {
 		throw new BadApiArgumentException("name", "not allowed (reserved)");
 	}
-	if (req.body.name.length < 3) {
-		throw new BadApiArgumentException(
-			"name",
-			"not allowed (too short, must be at least 3 characters)"
-		);
-	}
-	if (req.body.name.length > 32) {
-		throw new BadApiArgumentException(
-			"name",
-			"not allowed (too long, must be at most 32 characters)"
-		);
-	}
-
-	if (req.body.title && req.body.title.length > 255) {
-		throw new BadApiArgumentException(
-			"title",
-			"not allowed (too long, must be at most 255 characters)"
-		);
-	}
 
 	if (!ROOM_NAME_REGEX.exec(req.body.name)) {
 		throw new BadApiArgumentException("name", "not allowed (invalid characters)");
@@ -510,6 +492,15 @@ const errorHandler: ErrorRequestHandler = (err: Error, req, res) => {
 					message: err.message,
 				},
 			});
+		} else if (err instanceof ZodError) {
+			res.status(400).json({
+				success: false,
+				error: {
+					name: "ZodError",
+					message: err.message,
+					issues: err.issues,
+				},
+			});
 		} else {
 			res.status(400).json({
 				success: false,

server/package.json

@@ -52,7 +52,9 @@
     "uuid": "^9.0.0",
     "validator": "^13.7.0",
     "winston": "^3.10.0",
-    "ws": "^7.4.6"
+    "ws": "^7.4.6",
+    "zod": "^3.22.4",
+    "zod-validation-error": "^3.0.2"
   },
   "devDependencies": {
     "@types/convict": "^6.1.1",

yarn.lock

@@ -15397,6 +15397,16 @@ yocto-queue@^1.0.0:
   resolved "https://registry.yarnpkg.com/yocto-queue/-/yocto-queue-1.0.0.tgz#7f816433fb2cbc511ec8bf7d263c3b58a1a3c251"
   integrity sha512-9bnSc/HEW2uRy67wc+T8UwauLuPJVn28jb+GtJY16iiKWyvmYJRXVT4UamsAEGQfPohgr2q4Tq0sQbQlxTfi1g==
 
+zod-validation-error@^3.0.2:
+  version "3.0.2"
+  resolved "https://registry.yarnpkg.com/zod-validation-error/-/zod-validation-error-3.0.2.tgz#35a0f15e998d7fc88a569d50a9c1dbc3fb1abaae"
+  integrity sha512-21xGaDmnU7lJZ4J63n5GXWqi+rTzGy3gDHbuZ1jP6xrK/DEQGyOqs/xW7eH96tIfCOYm+ecCuT0bfajBRKEVUw==
+
+zod@^3.22.4:
+  version "3.22.4"
+  resolved "https://registry.yarnpkg.com/zod/-/zod-3.22.4.tgz#f31c3a9386f61b1f228af56faa9255e845cf3fff"
+  integrity sha512-iC+8Io04lddc+mVqQ9AZ7OQ2MrUKGN+oIQyq1vemgt46jwCwLfhq7/pwnBnNXXXZb8VTVLKwp9EDkx+ryxIWmg==
+
 zstddec@^0.1.0:
   version "0.1.0"
   resolved "https://registry.yarnpkg.com/zstddec/-/zstddec-0.1.0.tgz#7050f3f0e0c3978562d0c566b3e5a427d2bad7ec"