Input validation fails

[meliuos]

Environment

"@orpc/server": "^1.8.6",
"@orpc/client": "^1.8.6",
"@orpc/openapi": "^1.8.6",
"@orpc/zod": "^1.8.6",
"@orpc/client": "^1.8.6",
"@orpc/tanstack-query": "^1.8.6",

Reproduction

running api calls with contract inputs (input schemas different than z.void())
every call fails

Describe the bug

when run api calls with the input is not z.void() it fails
with input validation error expecting object revieving undefined everytime

Additional context

import { OpenAPIHandler } from "@orpc/openapi/node";
import { OpenAPIReferencePlugin } from "@orpc/openapi/plugins";
import { onError } from "@orpc/server";
import { RPCHandler } from "@orpc/server/node";
import { ZodToJsonSchemaConverter } from "@orpc/zod/zod4";
import { mobileAuth, webAuth } from "@theguestbook/auth";
import { importEnv, ServerEnvSchema } from "@theguestbook/env/server";
import { toNodeHandler } from "better-auth/node";
import cors from "cors";
import express, { type Request } from "express";
import { createMobileContext } from "./mobile/context";
import { mobileRouter } from "./mobile/routers";
import { createWebContext } from "./web/context";
import { webRouter } from "./web/routers";

// only import root .env in development
if (process.env.npm_lifecycle_script === "tsx watch src/index.ts") {
importEnv();
}

const PORT = 3000;
const SUCCESS_STATUS = 200; // for health check

// for validation on startup
ServerEnvSchema.parse(process.env);

const app = express();

app.use(
cors({
origin: true,
methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
credentials: true,
})
);

app.all("/webApi/auth/{*path}", toNodeHandler(webAuth));
app.all("/mobileApi/auth/{*path}", toNodeHandler(mobileAuth));

app.use(express.json());

app.get("/", (_req, res) => {
res.status(SUCCESS_STATUS).send("OK");
});

const webRpcHandler = new RPCHandler(webRouter, {
interceptors: [
onError((error) => {
// biome-ignore lint/suspicious/noConsole: error logs
console.dir(error);
}),
],
});

const mobileRpcHandler = new RPCHandler(mobileRouter, {
interceptors: [
onError((error) => {
// biome-ignore lint/suspicious/noConsole: error logs
console.dir(error);
}),
],
});

const webApiHandler = new OpenAPIHandler(webRouter, {
plugins: [
new OpenAPIReferencePlugin({
schemaConverters: [new ZodToJsonSchemaConverter()],
}),
],
interceptors: [
onError((error) => {
// biome-ignore lint/suspicious/noConsole: error logs
console.dir(error, { depth: Number.POSITIVE_INFINITY });
}),
],
});

const mobileApiHandler = new OpenAPIHandler(mobileRouter, {
plugins: [
new OpenAPIReferencePlugin({
schemaConverters: [new ZodToJsonSchemaConverter()],
}),
],
interceptors: [
onError((error) => {
// biome-ignore lint/suspicious/noConsole: error logs
console.dir(error);
}),
],
});

app.use(async (req: Request, res, next) => {
const rpcResult = await webRpcHandler.handle(req, res, {
prefix: "/webRpc",
context: await createWebContext(req),
});
if (rpcResult.matched) {
return;
}

const apiResult = await webApiHandler.handle(req, res, {
prefix: "/webApi",
context: await createWebContext(req),
});
if (apiResult.matched) {
return;
}

next();
});

app.use(async (req: Request, res, next) => {
const rpcResult = await mobileRpcHandler.handle(req, res, {
prefix: "/mobileRpc",
context: await createMobileContext(req),
});
if (rpcResult.matched) {
return;
}

const apiResult = await mobileApiHandler.handle(req, res, {
prefix: "/mobileApi",
context: await createMobileContext(req),
});
if (apiResult.matched) {
return;
}

next();
});

const port = process.env.PORT || PORT;
app.listen(port, () => {
// biome-ignore lint/suspicious/noConsole: simple log
console.log(Server is running on port ${port});
});

Logs

{
  "defined": false,
  "code": "BAD_REQUEST",
  "status": 400,
  "message": "Input validation failed",
  "data": {
    "issues": [
      {
        "expected": "object",
        "code": "invalid_type",
        "path": [],
        "message": "Invalid input: expected object, received undefined"
      }
    ]
  }
}

[dosubot]

Hi @meliuos! I'm Dosu and I’m helping the orpc team.

The most likely cause is that the server expects a defined object for endpoints with non-void input schemas, but is receiving undefined—usually because the client request is missing a JSON body or the Content-Type: application/json header. Both RPCHandler and OpenAPIHandler rely on the parsed request body and do not default to an empty object if the input is missing, so Zod throws the "expected object, received undefined" error for non-void schemas (source, source).

Check that your client is sending a JSON body and the correct Content-Type header for requests to endpoints expecting input. If you use the Request Validation Plugin on the client, make sure your contract is not minified (schemas must be present) and that the plugin is set up to validate requests before they reach the server (source). If the issue persists, inspect your client code for how requests are constructed and sent, especially for POST/PUT methods. If you need more help, sharing a minimal client request example and the endpoint contract would help diagnose further.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[meliuos]

curl -X POST http://localhost:3000/webRpc/organizationContracts/get -H "Content-Type: application/json" -b "better-auth.session_token=5HEDInAGz5tskWD1axCTUkJMwQrTCb9m" -d '{"json":{"id":"45eabdf0-1a91-4d51-aaf3-c3e334b77ae4"},"meta":[]}'
{"json":{"defined":false,"code":"BAD_REQUEST","status":400,"message":"Input validation failed","data":{"issues":[{"expected":"object","code":"invalid_type","path":[],"message":"Invalid input: expected object, received undefined"}]}}}

[dosubot]

The input validation error happens because the RPCHandler expects the input object directly, not nested under a json key. When you send {"json": {...}}, the server receives an undefined input for validation, which triggers the "expected object, received undefined" error (source).

To fix this, send the input as the root object. For your endpoint, try:

curl -X POST http://localhost:3000/webRpc/organizationContracts/get \
  -H "Content-Type: application/json" \
  -b "better-auth.session_token=5HEDInAGz5tskWD1axCTUkJMwQrTCb9m" \
  -d '{"id":"45eabdf0-1a91-4d51-aaf3-c3e334b77ae4"}'

If you need to make manual API calls (curl, Postman), it's recommended to use the OpenAPIHandler route instead of RPCHandler, since RPCHandler is designed for tightly-coupled oRPC clients and may not handle manual requests as expected (source).

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[meliuos]

=== RPC REQUEST DEBUG ===
Path: /webRpc/organizationContracts/get
Method: POST
Body: {
"json": {
"id": "45eabdf0-1a91-4d51-aaf3-c3e334b77ae4"
},
"meta": []
}
Headers: application/json
ORPCError: Input validation failed
at file:///home/mootez/Desktop/guestbook/node_modules/@orpc/server/dist/shared/server.Ds4HPpvH.mjs:162:15
at process.processTicksAndRejections (node:internal/process/task_queues:105:5) {
defined: false,
code: 'BAD_REQUEST',
status: 400,
data: { issues: [ [Object] ] },
[cause]: ValidationError: Input validation failed
at file:///home/mootez/Desktop/guestbook/node_modules/@orpc/server/dist/shared/server.Ds4HPpvH.mjs:167:18
at process.processTicksAndRejections (node:internal/process/task_queues:105:5) {
issues: [ [Object] ],
data: undefined
}
}

[dosubot]

The input validation error happens because the server expects the request body to match the input schema at the root level, not nested under a json key. For your endpoint, you should send:

{
  "id": "45eabdf0-1a91-4d51-aaf3-c3e334b77ae4"
}

instead of

{
  "json": { "id": "..." },
  "meta": []
}

This is because the RPCHandler validates the root object against your contract's schema, and extra wrapping causes it to receive undefined for the expected input, triggering the error "expected object, received undefined". If you're making manual requests (curl, Postman), always use the root object format. If you keep seeing this with an oRPC client, check how your client serializes requests.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[dinwwwh]

Please create minimal repro with exactly one handler, and make sure you read this if using RPCHandler: https://orpc.unnoq.com/docs/advanced/rpc-protocol