Migrated all API interfaces from docs to shared

[chomosuke]

From now on, use the API defined interfaces ensure the response type is correct as shangzhe has done in the me endpoint

[chomosuke]

I don't know why does the test fail...

[shangzhel]

From now on, convert post body to the appropriate type first using as before deconstructing.

No, absolutely DO NOT DO THIS. Using as to cast types bypasses TypeScript's type checking facility. The reason req.body is any instead of whatever else is because body can contain anything, including nothing. Consider the following JSON request body:

{}

When this gets to a route handler, req.body will equal {}. If at this point you cast it to something using as, like currently

body as LoginRequest

You are telling the TypeScript compiler to assume that body contains a non-null username and password that are strings, when there may not be. Afterwards, code that runs will use this incorrect assumption and either crash or expose some security hole. This is a prime example of forgetting to validate user input.

For the same reason, do not ever cast user input. Always follow these steps when accessing user-provided objects:

1. Check that object is not null (e.g. req.body != null)
   1. This avoids dereferencing null and undefined and generating exceptions
2. Check each individual property that you want is present or otherwise (e.g. typeof req.body.username === 'string')
   1. This checks that input values are the exactly the right types that you want, so that if you do value + 1 you know whether to expect the result to be 2 if value === 1 or 'something1' if value === 'something'.
3. Copy out exactly which properties you want and nothing more
   1. Malicious input can give itself properties that take the place of what you would normally assume is something else. A JSON string like {"toString":0} will replace the toString function with the number 0, making you crash when you try to call JSON.parse('{"toString":0}').toString(). Copying only the properties that you want makes sure nothing that you are unaware of gets overwritten.

[chomosuke]

okay how about this, now it's only migrating, the Request types are left in shared for future front end use

[shangzhel]

Looks good to me.