fix(qaas): add options validation #574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

ymc9 merged 27 commits into dev from fix/api-handler-options-validation

Jan 8, 2026

packages/server/src/api/common/schemas.ts

Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		import z from 'zod';

		export const loggerSchema = z.union([z.enum(['debug', 'info', 'warn', 'error']).array(), z.function()]);

packages/server/src/api/rest/index.ts

-Original file line number
+Diff line change
@@ Expand Up @@
     import { match } from 'ts-pattern';
     import UrlPattern from 'url-pattern';
     import z from 'zod';
+    import { fromError } from 'zod-validation-error/v4';
     import type { ApiHandler, LogConfig, RequestContext, Response } from '../../types';
+    import { getProcedureDef, mapProcedureArgs } from '../common/procedures';
+    import { loggerSchema } from '../common/schemas';
+    import { processSuperJsonRequestPayload } from '../common/utils';
     import { getZodErrorMessage, log, registerCustomSerializers } from '../utils';
-    import {
-        getProcedureDef,
-        mapProcedureArgs,
-    } from '../common/procedures';
-    import {
-        processSuperJsonRequestPayload,
-    } from '../common/utils';
     /**
      * Options for {@link RestApiHandler}
@@ Expand Down Expand Up @@
          */
         urlSegmentCharset?: string;
+        /**
+         * Mapping from model names to URL segment names.
+         */
         modelNameMapping?: Record<string, string>;
+        /**
+         * Mapping from model names to unique field name to be used as resource's ID.
+         */
         externalIdMapping?: Record<string, string>;
     };
@@ Expand Down Expand Up @@
         private externalIdMapping: Record<string, string>;
         constructor(private readonly options: RestApiHandlerOptions<Schema>) {
+            this.validateOptions(options);
             this.idDivider = options.idDivider ?? DEFAULT_ID_DIVIDER;
             const segmentCharset = options.urlSegmentCharset ?? 'a-zA-Z0-9-_~ %';
@@ Expand All @@
             this.buildSerializers();
         }
+        private validateOptions(options: RestApiHandlerOptions<Schema>) {
+            const schema = z.strictObject({
+                schema: z.object(),
+                log: loggerSchema.optional(),
+                endpoint: z.string().min(1),
+                pageSize: z.number().positive().optional(),
+                idDivider: z.string().min(1).optional(),
+                urlSegmentCharset: z.string().min(1).optional(),
+                modelNameMapping: z.record(z.string(), z.string()).optional(),
+                externalIdMapping: z.record(z.string(), z.string()).optional(),
+            });
+            const parseResult = schema.safeParse(options);
+            if (!parseResult.success) {
+                throw new Error(`Invalid options: ${fromError(parseResult.error)}`);
+            }
+        }
         get schema() {
             return this.options.schema;
         }
@@ Expand Down Expand Up @@
             try {
                 procInput = mapProcedureArgs(procDef, processedArgsPayload);
             } catch (err) {
-                return this.makeProcBadInputErrorResponse(err instanceof Error ? err.message : 'invalid procedure arguments');
+                return this.makeProcBadInputErrorResponse(
+                    err instanceof Error ? err.message : 'invalid procedure arguments',
+                );
             }
             try {
@@ Expand Down Expand Up @@
                 prev:
                     offset - limit >= 0 && offset - limit <= total - 1
                         ? this.replaceURLSearchParams(baseUrl, {
-                            'page[offset]': offset - limit,
-                            'page[limit]': limit,
-                        })
+                              'page[offset]': offset - limit,
+                              'page[limit]': limit,
+                          })
                         : null,
                 next:
                     offset + limit <= total - 1
                         ? this.replaceURLSearchParams(baseUrl, {
-                            'page[offset]': offset + limit,
-                            'page[limit]': limit,
-                        })
+                              'page[offset]': offset + limit,
+                              'page[limit]': limit,
+                          })
                         : null,
             }));
         }
@@ Expand Down Expand Up @@
                         } else {
                             currPayload[relation] = select
                                 ? {
-                                    select: { ...select },
-                                }
+                                      select: { ...select },
+                                  }
                                 : true;
                         }
                     }
@@ Expand Down @@

packages/server/src/api/rpc/index.ts

-Original file line number
+Diff line change
@@ Expand Up @@
     import type { SchemaDef } from '@zenstackhq/orm/schema';
     import SuperJSON from 'superjson';
     import { match } from 'ts-pattern';
+    import z from 'zod';
+    import { fromError } from 'zod-validation-error/v4';
     import type { ApiHandler, LogConfig, RequestContext, Response } from '../../types';
+    import { getProcedureDef, mapProcedureArgs, PROCEDURE_ROUTE_PREFIXES } from '../common/procedures';
+    import { loggerSchema } from '../common/schemas';
+    import { processSuperJsonRequestPayload, unmarshalQ } from '../common/utils';
     import { log, registerCustomSerializers } from '../utils';
-    import {
-        getProcedureDef,
-        mapProcedureArgs,
-    } from '../common/procedures';
-    import {
-        processSuperJsonRequestPayload,
-        unmarshalQ,
-    } from '../common/utils';
     registerCustomSerializers();
@@ Expand All @@
      * RPC style API request handler that mirrors the ZenStackClient API
      */
     export class RPCApiHandler<Schema extends SchemaDef = SchemaDef> implements ApiHandler<Schema> {
-        constructor(private readonly options: RPCApiHandlerOptions<Schema>) { }
+        constructor(private readonly options: RPCApiHandlerOptions<Schema>) {
+            this.validateOptions(options);
+        }
+        private validateOptions(options: RPCApiHandlerOptions<Schema>) {
+            const schema = z.strictObject({ schema: z.object(), log: loggerSchema.optional() });
+            const parseResult = schema.safeParse(options);
+            if (!parseResult.success) {
+                throw new Error(`Invalid options: ${fromError(parseResult.error)}`);
+            }
+        }
         get schema(): Schema {
             return this.options.schema;
@@ Expand All @@
                 return this.makeBadInputErrorResponse('invalid request path');
             }
-            if (model === '$procs') {
+            if (model === PROCEDURE_ROUTE_PREFIXES) {
                 return this.handleProcedureRequest({
                     client,
                     method: method.toUpperCase(),
@@ Expand Down Expand Up @@
                         return this.makeBadInputErrorResponse('invalid request method, only GET is supported');
                     }
                     try {
-                        args = query?.['q']
-                            ? unmarshalQ(query['q'] as string, query['meta'] as string | undefined)
-                            : {};
+                        args = query?.['q'] ? unmarshalQ(query['q'] as string, query['meta'] as string | undefined) : {};
                     } catch {
                         return this.makeBadInputErrorResponse('invalid "q" query parameter');
                     }
@@ Expand All @@
                         return this.makeBadInputErrorResponse('invalid request method, only DELETE is supported');
                     }
                     try {
-                        args = query?.['q']
-                            ? unmarshalQ(query['q'] as string, query['meta'] as string | undefined)
-                            : {};
+                        args = query?.['q'] ? unmarshalQ(query['q'] as string, query['meta'] as string | undefined) : {};
                     } catch (err) {
                         return this.makeBadInputErrorResponse(
                             err instanceof Error ? err.message : 'invalid "q" query parameter',
@@ Expand Down Expand Up @@
                         ? unmarshalQ(query['q'] as string, query['meta'] as string | undefined)
                         : undefined;
                 } catch (err) {
-                    return this.makeBadInputErrorResponse(err instanceof Error ? err.message : 'invalid "q" query parameter');
+                    return this.makeBadInputErrorResponse(
+                        err instanceof Error ? err.message : 'invalid "q" query parameter',
+                    );
                 }
             }
@@ Expand Down Expand Up @@
                 }
                 const response = { status: 200, body: responseBody };
-                log(this.options.log, 'debug', () => `sending response for "$procs.${proc}" request: ${safeJSONStringify(response)}`);
+                log(
+                    this.options.log,
+                    'debug',
+                    () => `sending response for "$procs.${proc}" request: ${safeJSONStringify(response)}`,
+                );
                 return response;
             } catch (err) {
                 log(this.options.log, 'error', `error occurred when handling "$procs.${proc}" request`, err);
@@ Expand Down Expand Up @@
                     status = 400;
                     error.dbErrorCode = err.dbErrorCode;
                 })
-                .otherwise(() => { });
+                .otherwise(() => {});
             const resp = { status, body: { error } };
             log(this.options.log, 'debug', () => `sending error response: ${safeJSONStringify(resp)}`);
@@ Expand Down @@

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(qaas): add options validation #574

Uh oh!

Diff view

Diff view

There are no files selected for viewing

Uh oh!

Uh oh!

Uh oh!

Uh oh!