Introduce zod for server-side validations #4397

apoorv-mishra · 2022-11-07T19:54:02Z

Todo

Towards #4284

tommoor · 2022-11-08T12:21:53Z

Refactor to use DocumentSchema in a top level blanket middleware for all documents APIs

I don't think we want this, the validated payload needs to be specific to each endpoint.

tommoor · 2022-11-08T12:22:55Z

I'm not sure if this is already the case but we should make sure that the body is typed correctly as part of this work, this is one of the big advantages of using zod.

apoorv-mishra · 2022-11-08T12:50:11Z

I don't think we want this, the validated payload needs to be specific to each endpoint.

Thought of doing this earlier, but not pursuing it now. Makes sense to keep it to individual routes.

tommoor

This is great work 🙏

tommoor · 2022-11-12T02:57:10Z

server/routes/api/types.ts

@@ -0,0 +1,284 @@
+import { isEmpty } from "lodash";


Lets move this file into @shared, we can then use it to ensure that requests from the frontend are also valid at some point.

There are two things - types and schemas. I assume you're referring to move only types? Not sure if it's required to move schemas into @shared.

I did mean both but it would just be to keep them colocated in that case, as you say I doubt schema would be needed on frontend

If we decide to restructure /api as follows, for example,

/api \--/attachments \--index.ts \--attachments.ts \--attachments.test.ts \--schema.ts

and if we also decide to share the types with frontend, it'd entail separating schemas and their types.

I say we keep them colocated under schema.ts and think about the frontend sharing part later. It's probably overengineering at this point. Thoughts @tommoor ?

Okay, works for me 👍 - one improvement at a time

tommoor · 2022-11-12T02:57:51Z

server/routes/api/types.ts

+  sort: z
+    .string()
+    .refine((val) =>
+      [...Object.keys(Document.rawAttributes), "index"].includes(val)


Moving to @shared will mean removing the import of Document but that's okay, we should probably be more selective over which attributes can be used for sorting here anyway. Lets start with createdAt, updatedAt, and index

tommoor · 2022-11-12T03:01:32Z

server/routes/api/documents.ts

+  DocumentsImportReq,
+  DocumentsCreateReqSchema,
+  DocumentsCreateReq,
+} from "@server/routes/api/types";


I think this is a case where it's better to just do something like...

import * as T from "@server/routes/api/types"; T.DocumentsListSchema

Maybe we can lose Req as they all have it?

Maybe we can lose Req as they all have it?

Didn't quite get. You mean rename, for example DocumentsCreateReqSchema -> DocumentsCreateSchema but keep DocumentsCreateReq unchanged?

I have Req there purposely to distinguish with Res, in case we have that in future, something like

APIContext<DocumentsCreateReq, DocumentsCreateRes>

rename, for example DocumentsCreateReqSchema -> DocumentsCreateSchema but keep DocumentsCreateReq unchanged?

Sorry, to be clear – this sounds good.

socket-security · 2022-11-12T05:23:00Z

Socket Security Pull Request Report

👍 No new dependency issues detected in pull request

Pull request report summary

Issue	Status
Install scripts	✅ 0 issues
Native code	✅ 0 issues
Bin script confusion	✅ 0 issues
Bin script shell injection	✅ 0 issues
Unresolved require	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	✅ 0 issues
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@2.4.2

Powered by socket.dev

tommoor · 2022-11-12T14:21:46Z

@SocketSecurity ignore koa-webpack-hot-middleware@1.0.3

wtf?

tommoor · 2022-11-15T02:59:28Z

Okay, I'm thankful for the extensive tests in api/documents – makes this a little less scary to merge but in hindsight I do wish we'd started with a less important set of endpoints 😅

…outline/outline into refactor/4284/server-side-validatations

Simplify import

apoorv-mishra · 2022-11-24T04:21:13Z

server/routes/api/documents/documents.test.ts

+  it("should return published document for urlId", async () => {
+    const { user, document } = await seed();
+    const res = await server.post("/api/documents.info", {
+      body: {
+        token: user.getJwtToken(),
+        id: document.urlId,
+      },
+    });
+    const body = await res.json();
+    expect(res.status).toEqual(200);
+    expect(body.data.id).toEqual(document.id);
+  });
+


Missed this! Thanks for adding 🙏

apoorv-mishra force-pushed the refactor/4284/server-side-validatations branch 5 times, most recently from 53d0477 to 198d3b8 Compare November 8, 2022 11:14

apoorv-mishra force-pushed the refactor/4284/server-side-validatations branch from be13eba to 70b47bb Compare November 10, 2022 12:15

apoorv-mishra changed the title ~~Use zod for server-side validations~~ Introduce zod for server-side validations Nov 10, 2022

apoorv-mishra force-pushed the refactor/4284/server-side-validatations branch from f0933d9 to 2c11b47 Compare November 11, 2022 15:20

apoorv-mishra marked this pull request as ready for review November 11, 2022 15:27

auto-assign bot requested a review from tommoor November 11, 2022 15:27

tommoor reviewed Nov 12, 2022

View reviewed changes

apoorv-mishra requested a review from tommoor November 12, 2022 05:22

apoorv-mishra added 14 commits November 12, 2022 10:56

chore(server): use zod for validations

a6fa490

fix(server): use ctx.input for documents.list

83daab3

fix(server): schema for documents.archived

905844c

fix(server): documents.deleted, documents.viewed & documents.drafts

302e898

fix(server): documents.info

3459223

fix(server): documents.export & documents.restore

096199f

fix(server): documents.search_titles & documents.search

e8a2214

fix(server): documents.templatize

7d535ed

fix(server): replace nullish() with optional()

c1bc9df

fix(server): documents.update

9b3f875

fix(server): documents.move

9ea32ef

fix(server): remaining

24299c1

fix(server): add validation for snippet min and max words

8e0ed73

fix(server): fix update types

2804f7f

apoorv-mishra added 4 commits November 12, 2022 10:56

fix(server): remove DocumentSchema

a675997

fix(server): collate duplicate schemas

17bbdd2

fix: typos

3627781

fix: reviews

b82c22d

apoorv-mishra force-pushed the refactor/4284/server-side-validatations branch from c5fde92 to b82c22d Compare November 12, 2022 05:26

tommoor approved these changes Nov 15, 2022

View reviewed changes

apoorv-mishra and others added 3 commits November 22, 2022 22:50

Merge branch 'main' into refactor/4284/server-side-validatations

59161eb

chore: Fixed case of Metrics import

0794450

fix: restructure /api

9c9ff87

apoorv-mishra force-pushed the refactor/4284/server-side-validatations branch from 7e27e60 to 9c9ff87 Compare November 23, 2022 11:42

apoorv-mishra requested a review from tommoor November 23, 2022 12:21

apoorv-mishra and others added 3 commits November 23, 2022 21:38

fix: loosen validation for id as it can be a slug too

32ac3b8

Merge branch 'refactor/4284/server-side-validatations' of github.com:…

c90a00e

…outline/outline into refactor/4284/server-side-validatations

Add test for query by slug

88fc614

Simplify import

tommoor approved these changes Nov 24, 2022

View reviewed changes

apoorv-mishra commented Nov 24, 2022

View reviewed changes

apoorv-mishra merged commit a6125be into main Nov 24, 2022

delete-merged-branch bot deleted the refactor/4284/server-side-validatations branch November 24, 2022 04:41

apoorv-mishra mentioned this pull request Nov 29, 2022

Make API response typed #4500

Closed

3 tasks

elidrissidev mentioned this pull request Dec 23, 2022

refactor: add server side validation schema for attachments #4606

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Introduce zod for server-side validations #4397

Introduce zod for server-side validations #4397

apoorv-mishra commented Nov 7, 2022 •

edited

tommoor commented Nov 8, 2022

tommoor commented Nov 8, 2022

apoorv-mishra commented Nov 8, 2022

tommoor left a comment

tommoor Nov 12, 2022

apoorv-mishra Nov 12, 2022

tommoor Nov 12, 2022

apoorv-mishra Nov 22, 2022

tommoor Nov 22, 2022

tommoor Nov 12, 2022

tommoor Nov 12, 2022

apoorv-mishra Nov 12, 2022

apoorv-mishra Nov 12, 2022 •

edited

tommoor Nov 12, 2022

tommoor Nov 12, 2022

socket-security bot commented Nov 12, 2022 •

edited

tommoor commented Nov 12, 2022

tommoor commented Nov 15, 2022

apoorv-mishra Nov 24, 2022

Introduce zod for server-side validations #4397

Introduce zod for server-side validations #4397

Conversation

apoorv-mishra commented Nov 7, 2022 • edited

Todo

tommoor commented Nov 8, 2022

tommoor commented Nov 8, 2022

apoorv-mishra commented Nov 8, 2022

tommoor left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

apoorv-mishra Nov 12, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

socket-security bot commented Nov 12, 2022 • edited

tommoor commented Nov 12, 2022

tommoor commented Nov 15, 2022

Choose a reason for hiding this comment

apoorv-mishra commented Nov 7, 2022 •

edited

apoorv-mishra Nov 12, 2022 •

edited

socket-security bot commented Nov 12, 2022 •

edited