Feat/nfc payload endpoint by Midoriya-w · Pull Request #189 · Dev-Card/DevCard

Midoriya-w · 2026-05-20T05:45:33Z

Closes #35

Changes:

Added apps/backend/src/routes/nfc.ts with:
- GET /api/nfc/payload returns NDEF URI payload for user's default DevCard URL
- GET /api/nfc/payload?card= returns card-specific URL with ownership validation
- Returns 403 if cardId doesn't belong to authenticated user
- Returns 404 if user or card not found
Registered route in apps/backend/src/app.ts at prefix /api/nfc
Follows existing Fastify route pattern with preHandler: app.authenticate

…idation

Harxhit · 2026-05-20T10:04:25Z

+
+    let username: string;
+
+    // Get username from user profile


Error handling around the DB logic should be improved here.

Wrapped the user fetch in try/catch with request.log.error logging and returns 500 with a clear error message if DB fails.

Harxhit · 2026-05-20T10:07:15Z

+  // GET /api/nfc/payload?card=<cardId> — returns payload for a specific card
+  app.get('/payload', async (request: FastifyRequest<{ Querystring: { card?: string } }>, reply: FastifyReply) => {
+    const userId = (request.user as any).id;
+    const { card: cardId } = request.query;


Could we validate the query params with Zod here it can be more robust.

Added a Zod schema nfcQuerySchema with safeParse to validate query params returns 400 with flattened error details if invalid.

Harxhit · 2026-05-20T10:08:25Z

+
+    if (cardId) {
+      // Validate card belongs to authenticated user
+      const card = await app.prisma.card.findUnique({


Could error handling can be improved here?

Wrapped card fetch in its own try/catch returns 404 if card not found, 403 if ownership mismatch, and 500 with request.log.error logging if DB fails.

Harxhit · 2026-05-20T10:10:58Z

+      });
+    }
+
+    return reply.send({


Typed response schema is missing here?

Adding a typed response interface now will push the fix shortly!

Please add typed response here.

Harxhit · 2026-05-20T10:11:17Z

+
+    return reply.send({
+      type: 'URI',
+      payload: `https://devcard.dev/${username}`,


Typed response schema missing here?

Harxhit · 2026-05-20T10:25:38Z

@Midoriya-w Your PR have merge conflicts.

Midoriya-w · 2026-05-20T10:27:49Z

Good catch! Adding a typed response interface now.

Midoriya-w · 2026-05-20T10:42:14Z

Hey @Harxhit! Resolved the merge conflicts in app.ts kept both nfcRoutes and eventRoutes registrations. Also addressed all review comments. Could you re-review when you get a chance?

Midoriya-w · 2026-05-20T10:49:01Z

Added NfcPayloadResponse type and updated both reply.send calls to reply.send() for full type safety.

Harxhit · 2026-05-20T11:47:06Z

@@ -1,4 +1,4 @@
-import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
+Dimport type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';


Fixed, removed the accidental D from the import statement.

Harxhit · 2026-05-20T11:50:15Z

@Midoriya-w Could you please add proofs for test in the PR descriptions.

Midoriya-w · 2026-05-20T11:55:31Z

Test Evidence

"Endpoint: GET /api/nfc/payload"

Returns { type: 'URI', payload: 'https://devcard.dev/<username>' } for authenticated user

"Endpoint: GET /api/nfc/payload?card="

Returns card-specific URL if card belongs to user
Returns 403 if card belongs to different user
Returns 404 if card not found
Returns 400 if cardId is not a valid UUID (Zod validation)
Returns 500 with logged error if DB fails

Harxhit · 2026-05-20T12:03:20Z

Test Evidence

"Endpoint: GET /api/nfc/payload"

* Returns `{ type: 'URI', payload: 'https://devcard.dev/<username>' }` for authenticated user

"Endpoint: GET /api/nfc/payload?card="

* Returns card-specific URL if card belongs to user

* Returns 403 if card belongs to different user

* Returns 404 if card not found

* Returns 400 if cardId is not a valid UUID (Zod validation)

* Returns 500 with logged error if DB fails

packages/shared/src/tests/cards.test.ts Add proofs for these in the PR description.

Midoriya-w · 2026-05-20T12:18:18Z

Hey @Harxhit! Here are the test proofs from packages/shared/src/tests/cards.test.ts:
validateCardPlatforms tests (7 cases):

-passes with valid platforms

fails with empty array
fails with unknown platform
fails with duplicate platforms
passes with exactly 10 platforms
fails with more than 10 platforms
ails with all invalid platforms

diffCardPlatforms tests (3 cases):

correctly identifies added, removed, unchanged
handles empty old card
handles identical cards

All 10 test cases cover the acceptance criteria edge cases

Harxhit · 2026-05-20T12:19:22Z

Hey @Harxhit! Here are the test proofs from packages/shared/src/tests/cards.test.ts:
validateCardPlatforms tests (7 cases):

-passes with valid platforms

fails with empty array

fails with unknown platform

fails with duplicate platforms

passes with exactly 10 platforms

fails with more than 10 platforms

ails with all invalid platforms

diffCardPlatforms tests (3 cases):

correctly identifies added, removed, unchanged

handles empty old card

handles identical cards

All 10 test cases cover the acceptance criteria edge cases

Please attach terminal screenshots to the description

Midoriya-w · 2026-05-20T14:05:53Z

Test Evidence

Shared Package Tests

All shared package tests pass successfully.

src/platforms.test.ts 9 tests passed
src/__tests__/cards.test.ts 10 tests passed
Total: 19 tests passed

Midoriya-w · 2026-05-20T14:06:10Z

Added terminal screenshots to the PR description as requested. All shared package tests are passing successfully.

Harxhit · 2026-05-20T14:54:04Z

+        where: { id: userId },
+        select: { username: true },
+      });
+


Catch position should be here

Refactored the code to narrow the try/catch scope as suggested. Thanks for the review!

Harxhit · 2026-05-20T14:56:02Z

+        const card = await app.prisma.card.findUnique({
+          where: { id: cardId },
+          select: { userId: true },
+        });


Catch position should be here.

Updated this section as well to keep the try/catch scoped only around the database call. Thanks for catching that.

Midoriya-w · 2026-05-21T07:55:10Z

Hey @ShantKhatri! Harxhit has reviewed and confirmed the changes look good. Could you do the final PA review when you get a chance?

Harxhit · 2026-05-21T08:53:14Z

@ShantKhatri Looks good to me your final review please.

Midoriya-w added 2 commits May 19, 2026 11:27

feat: add context-card diffing utility and validation layer

f9e9470

feat: add NFC tag payload generation endpoint with card ownership val…

b10c39f

…idation

Midoriya-w mentioned this pull request May 20, 2026

backend: implement NFC tag payload generation endpoint #35

Open

10 tasks

ShantKhatri requested a review from Harxhit May 20, 2026 09:31

Harxhit added the gssoc:approved Required label for every approved PR. Gives the base +50 points and enables contribution tracking. label May 20, 2026

Harxhit reviewed May 20, 2026

View reviewed changes

fix: add Zod query validation and improve error handling in NFC route

c416a3a

fix: resolve merge conflicts

a2ed2f6

fix: resolve merge conflicts in app.ts

f24bd45

fix: add typed response schema NfcPayloadResponse

5c84994

Midoriya-w requested a review from Harxhit May 20, 2026 10:48

Harxhit reviewed May 20, 2026

View reviewed changes

fix: remove typo in import statement in cards.ts

1fc961c

Harxhit reviewed May 20, 2026

View reviewed changes

refactor: narrow try catch scope in NFC payload route

41140d6

Midoriya-w requested a review from Harxhit May 21, 2026 04:06

		@@ -1,4 +1,4 @@
		import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
		Dimport type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';

Conversation

Midoriya-w commented May 20, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Harxhit May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Harxhit commented May 20, 2026

Uh oh!

Midoriya-w commented May 20, 2026

Uh oh!

Midoriya-w commented May 20, 2026

Uh oh!

Midoriya-w commented May 20, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Midoriya-w May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Harxhit commented May 20, 2026

Uh oh!

Midoriya-w commented May 20, 2026

Test Evidence

Uh oh!

Harxhit commented May 20, 2026

Test Evidence

Uh oh!

Midoriya-w commented May 20, 2026

Uh oh!

Harxhit commented May 20, 2026

Uh oh!

Midoriya-w commented May 20, 2026

Test Evidence

Shared Package Tests

Uh oh!

Midoriya-w commented May 20, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Midoriya-w commented May 21, 2026

Uh oh!

Harxhit commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Harxhit May 20, 2026 •

edited

Loading

Midoriya-w May 20, 2026 •

edited

Loading