fix(ui,schema): drop unknown form fields and coerce checkbox values for JSON [#2980]#2996
Merged
viniciusdacal merged 1 commit intomainfrom Apr 24, 2026
Merged
fix(ui,schema): drop unknown form fields and coerce checkbox values for JSON [#2980]#2996viniciusdacal merged 1 commit intomainfrom
viniciusdacal merged 1 commit intomainfrom
Conversation
…or JSON [#2980] Closes #2980. `form()` was sending checkbox values as raw strings in JSON bodies (`"concluida":"true"`) when the SDK lacked `meta.bodySchema`, causing the server to reject with `422 Expected boolean, received string`. - `coerceFormDataToSchema` now treats the schema as the contract: only fields declared in the shape are included, unknown form keys are dropped (no `tenantId` injection via DevTools, no leaked stale inputs). - `form()` no-schema fallback uses `formDataToObject(fd, { nested: true, coerce: true })` so plain checkbox/number inputs serialize as boolean / number when there is no schema to drive precise coercion. Custom non-Vertz schema adapters keep their existing behavior — values pass through untouched so user-supplied parsers stay in control. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #2980.
form()was sending checkbox values as raw strings in JSON bodies ("concluida":"true") when the SDK lackedmeta.bodySchema, causing the server to reject the request with422 Expected boolean, received string. Two changes:coerceFormDataToSchemanow treats the schema as the contract: only fields declared in the shape are included; unknown form keys are dropped. PreventstenantIdinjection via DevTools and removes a class of.strict()-rejection footguns.form()no-schema fallback usesformDataToObject(fd, { nested: true, coerce: true })so plain checkbox / number inputs serialize asboolean/numbereven when there is no schema to drive precise coercion.Custom non-Vertz schema adapters keep their existing behavior — values pass through untouched so user-supplied parsers stay in control.
Public API Changes
coerceFormDataToSchema(formData, vertzSchema)— breaking: no longer forwards form fields that are not declared in the schema's shape. Previously these survived toschema.parse()for.strict()schemas to reject; now they are silently dropped both client-side and on the server's form-encoded body parsing path.form()no-schema fallback — additive: now coerces"true"/"false"/ numeric strings before sending JSON.Test plan
packages/ui/src/form/__tests__/form-coercion.test.tscover both form() does not coerce checkbox string values to boolean when sending JSON #2980 scenarios (no meta + checkbox value="true", no meta + numeric input).coerceFormDataToSchema — unknown keystests updated to assert drop behavior (top-level and nested).vtz test packages/schema packages/ui packages/server packages/integration-tests— all passing (pre-existing JSX/dts failures unrelated).lint,build-typecheck,test,trojan-source.🤖 Generated with Claude Code