@de-otio/trellis 0.4.0

package/dist/lib/validation/feature-toggle-schemas.js

@@ -0,0 +1,274 @@
+"use strict";
+/**
+ * Feature Toggle Validation Schemas
+ *
+ * Comprehensive input validation schemas for feature toggle API endpoints.
+ * Uses Zod for runtime validation and type safety.
+ *
+ * SECURITY: These schemas prevent:
+ * - SQL injection attacks
+ * - XSS attacks
+ * - Invalid data types
+ * - Out-of-range values
+ * - Malformed input
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PublicAPIQuerySchema = exports.BatchEvaluateSchema = exports.UpdateToggleStateSchema = exports.UpdateToggleSchema = exports.CreateToggleSchema = exports.FeatureToggleStateConfigSchema = exports.TargetingSchema = exports.TargetingTypeSchema = exports.FeatureToggleStateSchema = exports.FeatureToggleCategorySchema = exports.RegionSchema = exports.PercentageSchema = exports.FeatureToggleKeySchema = void 0;
+const zod_1 = require("zod");
+/**
+ * SQL injection pattern detection helper
+ *
+ * SECURITY: Detects common SQL injection patterns in user input
+ */
+function containsSQLInjection(input) {
+    const sqlPatterns = [
+        /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC|EXECUTE)\b)/i,
+        /(--|#|\/\*|\*\/)/,
+        /(;|\||&)/,
+        /(UNION.*SELECT)/i,
+        /(OR\s+1\s*=\s*1)/i,
+        /(OR\s+'1'\s*=\s*'1')/i,
+    ];
+    return sqlPatterns.some((pattern) => pattern.test(input));
+}
+/**
+ * Feature toggle key validation schema
+ *
+ * Rules:
+ * - 1-100 characters
+ * - Only lowercase letters, numbers, and underscores
+ * - Cannot start or end with underscore
+ * - Cannot contain double underscores
+ * - Must not contain SQL injection patterns
+ */
+exports.FeatureToggleKeySchema = zod_1.z
+    .string()
+    .min(1, "Feature toggle key is required")
+    .max(100, "Feature toggle key must be 100 characters or less")
+    .regex(/^[a-z0-9_]+$/, "Feature toggle key can only contain lowercase letters, numbers, and underscores")
+    .refine((key) => !key.includes("__"), {
+    message: "Feature toggle key cannot contain double underscores",
+})
+    .refine((key) => !key.startsWith("_") && !key.endsWith("_"), {
+    message: "Feature toggle key cannot start or end with underscore",
+})
+    .refine((key) => !containsSQLInjection(key), {
+    message: "Invalid characters detected in feature toggle key",
+});
+/**
+ * Percentage validation schema
+ *
+ * Rules:
+ * - Integer between 0 and 100
+ */
+exports.PercentageSchema = zod_1.z.number().int().min(0).max(100);
+/**
+ * Region validation schema
+ *
+ * Rules:
+ * - Must be one of: US, EU, CN
+ */
+exports.RegionSchema = zod_1.z.enum(["US", "EU", "CN"], {
+    errorMap: () => ({ message: "Region must be one of: US, EU, CN" }),
+});
+/**
+ * Feature toggle category validation schema
+ *
+ * Rules:
+ * - Must be one of the defined categories
+ */
+exports.FeatureToggleCategorySchema = zod_1.z.enum([
+    "AUTHENTICATION",
+    "FEATURES",
+    "PERFORMANCE",
+    "SECURITY",
+    "SERVICE_PROVIDER",
+    "EXPERIMENTAL",
+], {
+    errorMap: () => ({
+        message: "Category must be one of: AUTHENTICATION, FEATURES, PERFORMANCE, SECURITY, SERVICE_PROVIDER, EXPERIMENTAL",
+    }),
+});
+/**
+ * Feature toggle state validation schema
+ *
+ * Rules:
+ * - Must be one of: ENABLED, DISABLED, GRADUAL
+ */
+exports.FeatureToggleStateSchema = zod_1.z.enum(["ENABLED", "DISABLED", "GRADUAL"], {
+    errorMap: () => ({
+        message: "State must be one of: ENABLED, DISABLED, GRADUAL",
+    }),
+});
+/**
+ * Targeting type validation schema
+ *
+ * Rules:
+ * - Must be one of the defined targeting types
+ */
+exports.TargetingTypeSchema = zod_1.z.enum(["PERCENTAGE", "USER_LIST", "USER_SEGMENT", "REGION", "ALL"], {
+    errorMap: () => ({
+        message: "Targeting type must be one of: PERCENTAGE, USER_LIST, USER_SEGMENT, REGION, ALL",
+    }),
+});
+/**
+ * Targeting rule validation schema
+ *
+ * Rules:
+ * - Type must be valid targeting type
+ * - Value must be a string
+ * - Priority must be non-negative integer
+ */
+exports.TargetingSchema = zod_1.z.object({
+    type: exports.TargetingTypeSchema,
+    value: zod_1.z
+        .string()
+        .max(1000, "Targeting value must be 1000 characters or less"),
+    priority: zod_1.z.number().int().min(0, "Priority must be non-negative"),
+});
+/**
+ * Feature toggle state configuration schema
+ *
+ * Rules:
+ * - Region must be valid
+ * - Enabled must be boolean
+ * - State must be valid
+ * - Percentage must be 0-100
+ * - Targeting rules are optional
+ */
+exports.FeatureToggleStateConfigSchema = zod_1.z.object({
+    region: exports.RegionSchema,
+    enabled: zod_1.z.boolean(),
+    state: exports.FeatureToggleStateSchema,
+    percentage: exports.PercentageSchema,
+    targeting: zod_1.z.array(exports.TargetingSchema).optional(),
+});
+/**
+ * Create feature toggle request schema
+ *
+ * Rules:
+ * - Key must be valid toggle key format
+ * - Name must be 1-200 characters
+ * - Description is optional, max 1000 characters
+ * - Category must be valid
+ * - isCritical must be boolean
+ * - Initial states are optional array
+ */
+exports.CreateToggleSchema = zod_1.z
+    .object({
+    key: exports.FeatureToggleKeySchema,
+    name: zod_1.z
+        .string()
+        .min(1, "Name is required")
+        .max(200, "Name must be 200 characters or less")
+        .refine((name) => !containsSQLInjection(name), {
+        message: "Invalid characters detected in name",
+    }),
+    description: zod_1.z
+        .string()
+        .max(1000, "Description must be 1000 characters or less")
+        .optional()
+        .refine((desc) => !desc || !containsSQLInjection(desc), {
+        message: "Invalid characters detected in description",
+    }),
+    category: exports.FeatureToggleCategorySchema,
+    isCritical: zod_1.z.boolean().default(false),
+    initialStates: zod_1.z.array(exports.FeatureToggleStateConfigSchema).optional(),
+})
+    .refine((data) => {
+    // If description provided, check for SQL injection
+    if (data.description) {
+        return !containsSQLInjection(data.description);
+    }
+    return true;
+}, {
+    message: "Invalid characters detected in description",
+    path: ["description"],
+});
+/**
+ * Update feature toggle request schema
+ *
+ * Rules:
+ * - All fields optional
+ * - If provided, must match their respective schemas
+ */
+exports.UpdateToggleSchema = zod_1.z
+    .object({
+    name: zod_1.z
+        .string()
+        .min(1, "Name cannot be empty")
+        .max(200, "Name must be 200 characters or less")
+        .refine((name) => !containsSQLInjection(name), {
+        message: "Invalid characters detected in name",
+    })
+        .optional(),
+    description: zod_1.z
+        .string()
+        .max(1000, "Description must be 1000 characters or less")
+        .refine((desc) => !desc || !containsSQLInjection(desc), {
+        message: "Invalid characters detected in description",
+    })
+        .optional(),
+    category: exports.FeatureToggleCategorySchema.optional(),
+    isCritical: zod_1.z.boolean().optional(),
+})
+    .refine((data) => {
+    // If description provided, check for SQL injection
+    if (data.description) {
+        return !containsSQLInjection(data.description);
+    }
+    return true;
+}, {
+    message: "Invalid characters detected in description",
+    path: ["description"],
+});
+/**
+ * Update feature toggle state request schema
+ *
+ * Rules:
+ * - Region must be valid
+ * - Enabled, state, percentage must match their schemas
+ * - Targeting rules optional
+ */
+exports.UpdateToggleStateSchema = zod_1.z.object({
+    region: exports.RegionSchema,
+    enabled: zod_1.z.boolean().optional(),
+    state: exports.FeatureToggleStateSchema.optional(),
+    percentage: exports.PercentageSchema.optional(),
+    targeting: zod_1.z.array(exports.TargetingSchema).optional(),
+    reason: zod_1.z
+        .string()
+        .max(500, "Reason must be 500 characters or less")
+        .optional(),
+});
+/**
+ * Batch evaluate request schema
+ *
+ * Rules:
+ * - Toggles must be array of valid toggle keys
+ * - Context must have valid region
+ * - UserId optional
+ */
+exports.BatchEvaluateSchema = zod_1.z.object({
+    toggles: zod_1.z
+        .array(exports.FeatureToggleKeySchema)
+        .min(1, "At least one toggle key is required")
+        .max(100, "Maximum 100 toggles per batch request"),
+    context: zod_1.z.object({
+        userId: zod_1.z.string().max(255).optional(),
+        region: exports.RegionSchema,
+        userSegment: zod_1.z.string().max(100).optional(),
+    }),
+});
+/**
+ * Public API query parameters schema
+ *
+ * Rules:
+ * - Region optional, must be valid if provided
+ * - UserId optional, max 255 characters
+ */
+exports.PublicAPIQuerySchema = zod_1.z.object({
+    region: exports.RegionSchema.optional(),
+    userId: zod_1.z.string().max(255).optional(),
+});
+//# sourceMappingURL=feature-toggle-schemas.js.map

package/dist/lib/validation/feature-toggle-schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature-toggle-schemas.js","sourceRoot":"","sources":["../../../src/lib/validation/feature-toggle-schemas.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAEH,6BAAwB;AAExB;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,WAAW,GAAG;QAClB,qEAAqE;QACrE,kBAAkB;QAClB,UAAU;QACV,kBAAkB;QAClB,mBAAmB;QACnB,uBAAuB;KACxB,CAAC;IAEF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;GASG;AACU,QAAA,sBAAsB,GAAG,OAAC;KACpC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,gCAAgC,CAAC;KACxC,GAAG,CAAC,GAAG,EAAE,mDAAmD,CAAC;KAC7D,KAAK,CACJ,cAAc,EACd,iFAAiF,CAClF;KACA,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;IACpC,OAAO,EAAE,sDAAsD;CAChE,CAAC;KACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;IAC3D,OAAO,EAAE,wDAAwD;CAClE,CAAC;KACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE;IAC3C,OAAO,EAAE,mDAAmD;CAC7D,CAAC,CAAC;AAEL;;;;;GAKG;AACU,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEjE;;;;;GAKG;AACU,QAAA,YAAY,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;IACrD,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;CACnE,CAAC,CAAC;AAEH;;;;;GAKG;AACU,QAAA,2BAA2B,GAAG,OAAC,CAAC,IAAI,CAC/C;IACE,gBAAgB;IAChB,UAAU;IACV,aAAa;IACb,UAAU;IACV,kBAAkB;IAClB,cAAc;CACf,EACD;IACE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACf,OAAO,EACL,0GAA0G;KAC7G,CAAC;CACH,CACF,CAAC;AAEF;;;;;GAKG;AACU,QAAA,wBAAwB,GAAG,OAAC,CAAC,IAAI,CAC5C,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,EAClC;IACE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACf,OAAO,EAAE,kDAAkD;KAC5D,CAAC;CACH,CACF,CAAC;AAEF;;;;;GAKG;AACU,QAAA,mBAAmB,GAAG,OAAC,CAAC,IAAI,CACvC,CAAC,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,CAAC,EAC5D;IACE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACf,OAAO,EACL,iFAAiF;KACpF,CAAC;CACH,CACF,CAAC;AAEF;;;;;;;GAOG;AACU,QAAA,eAAe,GAAG,OAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,2BAAmB;IACzB,KAAK,EAAE,OAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,EAAE,iDAAiD,CAAC;IAC/D,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,+BAA+B,CAAC;CACnE,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACU,QAAA,8BAA8B,GAAG,OAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,oBAAY;IACpB,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,gCAAwB;IAC/B,UAAU,EAAE,wBAAgB;IAC5B,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,uBAAe,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACU,QAAA,kBAAkB,GAAG,OAAC;KAChC,MAAM,CAAC;IACN,GAAG,EAAE,8BAAsB;IAC3B,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC;SAC1B,GAAG,CAAC,GAAG,EAAE,qCAAqC,CAAC;SAC/C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE;QAC7C,OAAO,EAAE,qCAAqC;KAC/C,CAAC;IACJ,WAAW,EAAE,OAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,EAAE,6CAA6C,CAAC;SACxD,QAAQ,EAAE;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE;QACtD,OAAO,EAAE,4CAA4C;KACtD,CAAC;IACJ,QAAQ,EAAE,mCAA2B;IACrC,UAAU,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,sCAA8B,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC;KACD,MAAM,CACL,CAAC,IAAI,EAAE,EAAE;IACP,mDAAmD;IACnD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,EACD;IACE,OAAO,EAAE,4CAA4C;IACrD,IAAI,EAAE,CAAC,aAAa,CAAC;CACtB,CACF,CAAC;AAEJ;;;;;;GAMG;AACU,QAAA,kBAAkB,GAAG,OAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;SAC9B,GAAG,CAAC,GAAG,EAAE,qCAAqC,CAAC;SAC/C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE;QAC7C,OAAO,EAAE,qCAAqC;KAC/C,CAAC;SACD,QAAQ,EAAE;IACb,WAAW,EAAE,OAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,EAAE,6CAA6C,CAAC;SACxD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE;QACtD,OAAO,EAAE,4CAA4C;KACtD,CAAC;SACD,QAAQ,EAAE;IACb,QAAQ,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,CACL,CAAC,IAAI,EAAE,EAAE;IACP,mDAAmD;IACnD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,EACD;IACE,OAAO,EAAE,4CAA4C;IACrD,IAAI,EAAE,CAAC,aAAa,CAAC;CACtB,CACF,CAAC;AAEJ;;;;;;;GAOG;AACU,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,oBAAY;IACpB,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,gCAAwB,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,wBAAgB,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,uBAAe,CAAC,CAAC,QAAQ,EAAE;IAC9C,MAAM,EAAE,OAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,GAAG,EAAE,uCAAuC,CAAC;SACjD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;;;;;GAOG;AACU,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,OAAC;SACP,KAAK,CAAC,8BAAsB,CAAC;SAC7B,GAAG,CAAC,CAAC,EAAE,qCAAqC,CAAC;SAC7C,GAAG,CAAC,GAAG,EAAE,uCAAuC,CAAC;IACpD,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QACtC,MAAM,EAAE,oBAAY;QACpB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KAC5C,CAAC;CACH,CAAC,CAAC;AAEH;;;;;;GAMG;AACU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,oBAAY,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC"}

package/dist/lib/validation/validate-request.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Request Validation Middleware
+ *
+ * Helper functions for validating API requests using Zod schemas.
+ * Provides consistent error handling and response formatting.
+ */
+import { z, ZodSchema } from "zod";
+/**
+ * Validation error response format
+ */
+export interface ValidationErrorResponse {
+    error: {
+        code: "VALIDATION_ERROR";
+        message: string;
+        details: Array<{
+            field: string;
+            message: string;
+        }>;
+    };
+}
+/**
+ * Validate request body against a Zod schema
+ *
+ * @param schema - Zod schema to validate against
+ * @param data - Data to validate
+ * @returns Validated data or throws ValidationError
+ * @throws {ValidationError} If validation fails
+ */
+export declare function validateBody<T extends ZodSchema>(schema: T, data: unknown): z.infer<T>;
+/**
+ * Validate query parameters against a Zod schema
+ *
+ * @param schema - Zod schema to validate against
+ * @param params - Query parameters to validate
+ * @returns Validated data or throws ValidationError
+ * @throws {ValidationError} If validation fails
+ */
+export declare function validateQuery<T extends ZodSchema>(schema: T, params: Record<string, string | undefined>): z.infer<T>;
+/**
+ * Validate path parameters
+ *
+ * @param schema - Zod schema to validate against
+ * @param value - Path parameter value to validate
+ * @returns Validated data or throws ValidationError
+ * @throws {ValidationError} If validation fails
+ */
+export declare function validatePathParam<T extends ZodSchema>(schema: T, value: string): z.infer<T>;
+/**
+ * Custom validation error class
+ */
+export declare class ValidationError extends Error {
+    readonly zodErrors: z.ZodIssue[];
+    constructor(message: string, zodErrors: z.ZodIssue[]);
+    /**
+     * Convert validation error to API response format
+     */
+    toResponse(): ValidationErrorResponse;
+    /**
+     * Get HTTP status code for validation error
+     */
+    getStatusCode(): number;
+}
+/**
+ * Safe validation wrapper that catches errors and returns formatted response
+ *
+ * @param schema - Zod schema to validate against
+ * @param data - Data to validate
+ * @returns Object with success flag and either validated data or error response
+ */
+export declare function safeValidate<T extends ZodSchema>(schema: T, data: unknown): {
+    success: boolean;
+    data?: z.infer<T>;
+    error?: ValidationErrorResponse;
+};
+//# sourceMappingURL=validate-request.d.ts.map

package/dist/lib/validation/validate-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-request.d.ts","sourceRoot":"","sources":["../../../src/lib/validation/validate-request.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAY,SAAS,EAAE,MAAM,KAAK,CAAC;AAE7C;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE;QACL,IAAI,EAAE,kBAAkB,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,KAAK,CAAC;YACb,KAAK,EAAE,MAAM,CAAC;YACd,OAAO,EAAE,MAAM,CAAC;SACjB,CAAC,CAAC;KACJ,CAAC;CACH;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,SAAS,EAC9C,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,OAAO,GACZ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CA8CZ;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,SAAS,EAC/C,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACzC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAoBZ;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,SAAS,EACnD,MAAM,EAAE,CAAC,EACT,KAAK,EAAE,MAAM,GACZ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CA0BZ;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE;gBADvC,OAAO,EAAE,MAAM,EACC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE;IAMzC;;OAEG;IACH,UAAU,IAAI,uBAAuB;IAarC;;OAEG;IACH,aAAa,IAAI,MAAM;CAGxB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,SAAS,EAC9C,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,OAAO,GACZ;IACD,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,KAAK,CAAC,EAAE,uBAAuB,CAAC;CACjC,CAoBA"}

package/dist/lib/validation/validate-request.js

@@ -0,0 +1,183 @@
+"use strict";
+/**
+ * Request Validation Middleware
+ *
+ * Helper functions for validating API requests using Zod schemas.
+ * Provides consistent error handling and response formatting.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ValidationError = void 0;
+exports.validateBody = validateBody;
+exports.validateQuery = validateQuery;
+exports.validatePathParam = validatePathParam;
+exports.safeValidate = safeValidate;
+const zod_1 = require("zod");
+/**
+ * Validate request body against a Zod schema
+ *
+ * @param schema - Zod schema to validate against
+ * @param data - Data to validate
+ * @returns Validated data or throws ValidationError
+ * @throws {ValidationError} If validation fails
+ */
+function validateBody(schema, data) {
+    // Ensure data is defined before validation
+    if (data === undefined || data === null) {
+        throw new ValidationError("Validation failed", [
+            {
+                code: "invalid_type",
+                expected: "object",
+                received: data === null ? "null" : "undefined",
+                path: [],
+                message: "Request body is required",
+            },
+        ]);
+    }
+    try {
+        // Wrap in try-catch to handle any unexpected errors during parsing
+        const result = schema.parse(data);
+        return result;
+    }
+    catch (error) {
+        // If error is about accessing 'length' on undefined, provide a clearer error
+        if (error instanceof Error &&
+            error.message.includes("Cannot read properties of undefined (reading 'length')")) {
+            throw new ValidationError("Validation failed: Invalid data type", [
+                {
+                    code: "invalid_type",
+                    expected: "object",
+                    received: typeof data,
+                    path: [],
+                    message: "Request body contains invalid data types",
+                },
+            ]);
+        }
+        if (error instanceof zod_1.ZodError) {
+            const validationError = new ValidationError("Validation failed", error.errors);
+            throw validationError;
+        }
+        throw error;
+    }
+}
+/**
+ * Validate query parameters against a Zod schema
+ *
+ * @param schema - Zod schema to validate against
+ * @param params - Query parameters to validate
+ * @returns Validated data or throws ValidationError
+ * @throws {ValidationError} If validation fails
+ */
+function validateQuery(schema, params) {
+    try {
+        // Convert query params to object, handling optional values
+        const queryObj = {};
+        for (const [key, value] of Object.entries(params)) {
+            if (value !== undefined) {
+                queryObj[key] = value;
+            }
+        }
+        return schema.parse(queryObj);
+    }
+    catch (error) {
+        if (error instanceof zod_1.ZodError) {
+            const validationError = new ValidationError("Query parameter validation failed", error.errors);
+            throw validationError;
+        }
+        throw error;
+    }
+}
+/**
+ * Validate path parameters
+ *
+ * @param schema - Zod schema to validate against
+ * @param value - Path parameter value to validate
+ * @returns Validated data or throws ValidationError
+ * @throws {ValidationError} If validation fails
+ */
+function validatePathParam(schema, value) {
+    // Ensure value is a string before validation
+    if (value === undefined || value === null || typeof value !== "string") {
+        throw new ValidationError("Path parameter validation failed", [
+            {
+                code: "invalid_type",
+                expected: "string",
+                received: value === null ? "null" : typeof value,
+                path: [],
+                message: `Path parameter must be a string, received ${value === null ? "null" : typeof value}`,
+            },
+        ]);
+    }
+    try {
+        return schema.parse(value);
+    }
+    catch (error) {
+        if (error instanceof zod_1.ZodError) {
+            const validationError = new ValidationError("Path parameter validation failed", error.errors);
+            throw validationError;
+        }
+        throw error;
+    }
+}
+/**
+ * Custom validation error class
+ */
+class ValidationError extends Error {
+    zodErrors;
+    constructor(message, zodErrors) {
+        super(message);
+        this.zodErrors = zodErrors;
+        this.name = "ValidationError";
+    }
+    /**
+     * Convert validation error to API response format
+     */
+    toResponse() {
+        return {
+            error: {
+                code: "VALIDATION_ERROR",
+                message: this.message,
+                details: this.zodErrors.map((err) => ({
+                    field: err.path.join("."),
+                    message: err.message,
+                })),
+            },
+        };
+    }
+    /**
+     * Get HTTP status code for validation error
+     */
+    getStatusCode() {
+        return 400; // Bad Request
+    }
+}
+exports.ValidationError = ValidationError;
+/**
+ * Safe validation wrapper that catches errors and returns formatted response
+ *
+ * @param schema - Zod schema to validate against
+ * @param data - Data to validate
+ * @returns Object with success flag and either validated data or error response
+ */
+function safeValidate(schema, data) {
+    try {
+        const validated = validateBody(schema, data);
+        return { success: true, data: validated };
+    }
+    catch (error) {
+        if (error instanceof ValidationError) {
+            return { success: false, error: error.toResponse() };
+        }
+        // Unexpected error
+        return {
+            success: false,
+            error: {
+                error: {
+                    code: "VALIDATION_ERROR",
+                    message: "An unexpected validation error occurred",
+                    details: [],
+                },
+            },
+        };
+    }
+}
+//# sourceMappingURL=validate-request.js.map

package/dist/lib/validation/validate-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-request.js","sourceRoot":"","sources":["../../../src/lib/validation/validate-request.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA0BH,oCAiDC;AAUD,sCAuBC;AAUD,8CA6BC;AA6CD,oCA2BC;AAzND,6BAA6C;AAgB7C;;;;;;;GAOG;AACH,SAAgB,YAAY,CAC1B,MAAS,EACT,IAAa;IAEb,2CAA2C;IAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE;YAC7C;gBACE,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;gBAC9C,IAAI,EAAE,EAAE;gBACR,OAAO,EAAE,0BAA0B;aACpC;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,mEAAmE;QACnE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6EAA6E;QAC7E,IACE,KAAK,YAAY,KAAK;YACtB,KAAK,CAAC,OAAO,CAAC,QAAQ,CACpB,wDAAwD,CACzD,EACD,CAAC;YACD,MAAM,IAAI,eAAe,CAAC,sCAAsC,EAAE;gBAChE;oBACE,IAAI,EAAE,cAAc;oBACpB,QAAQ,EAAE,QAAQ;oBAClB,QAAQ,EAAE,OAAO,IAAI;oBACrB,IAAI,EAAE,EAAE;oBACR,OAAO,EAAE,0CAA0C;iBACpD;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,YAAY,cAAQ,EAAE,CAAC;YAC9B,MAAM,eAAe,GAAG,IAAI,eAAe,CACzC,mBAAmB,EACnB,KAAK,CAAC,MAAM,CACb,CAAC;YACF,MAAM,eAAe,CAAC;QACxB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,aAAa,CAC3B,MAAS,EACT,MAA0C;IAE1C,IAAI,CAAC;QACH,2DAA2D;QAC3D,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAQ,EAAE,CAAC;YAC9B,MAAM,eAAe,GAAG,IAAI,eAAe,CACzC,mCAAmC,EACnC,KAAK,CAAC,MAAM,CACb,CAAC;YACF,MAAM,eAAe,CAAC;QACxB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAC/B,MAAS,EACT,KAAa;IAEb,6CAA6C;IAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAE;YAC5D;gBACE,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK;gBAChD,IAAI,EAAE,EAAE;gBACR,OAAO,EAAE,6CAA6C,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE;aAC/F;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAQ,EAAE,CAAC;YAC9B,MAAM,eAAe,GAAG,IAAI,eAAe,CACzC,kCAAkC,EAClC,KAAK,CAAC,MAAM,CACb,CAAC;YACF,MAAM,eAAe,CAAC;QACxB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAa,eAAgB,SAAQ,KAAK;IAGtB;IAFlB,YACE,OAAe,EACC,SAAuB;QAEvC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,cAAS,GAAT,SAAS,CAAc;QAGvC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACpC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;oBACzB,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC,CAAC;aACJ;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,GAAG,CAAC,CAAC,cAAc;IAC5B,CAAC;CACF;AA/BD,0CA+BC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAC1B,MAAS,EACT,IAAa;IAMb,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;QACvD,CAAC;QACD,mBAAmB;QACnB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE;gBACL,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,yCAAyC;oBAClD,OAAO,EAAE,EAAE;iBACZ;aACF;SACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/lib/validation.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Input Validation
+ *
+ * Validation schemas and utilities for API endpoints.
+ */
+/**
+ * Entity profile input interface (replaces Dog profile)
+ */
+export interface EntityProfileInput {
+    name: string;
+    entityType?: string;
+    metadata?: {
+        breed?: string;
+        bio?: string;
+        birthdate?: string;
+        privacy?: "public" | "followers" | "private";
+        [key: string]: any;
+    };
+    id?: string;
+}
+/**
+ * Validator class for input validation
+ */
+export declare class Validator {
+    /**
+     * Validate entity profile input
+     */
+    validateEntityProfile(input: any): {
+        valid: boolean;
+        data?: EntityProfileInput;
+        error?: string;
+    };
+    /**
+     * Validate taxonomy taxon IDs
+     * Ensures taxon IDs are in the correct format: dimension:category:taxon
+     */
+    validateTaxonIds(taxonIds: any): string[];
+    /**
+     * Sanitize error for response (don't leak internal details)
+     *
+     * SECURITY: Prevents exposure of:
+     * - Database connection strings (postgresql://, prisma://, etc.)
+     * - Stack traces
+     * - Internal file paths
+     * - Sensitive environment variable names
+     * - Internal error types
+     */
+    sanitizeError(error: unknown): string;
+}
+//# sourceMappingURL=validation.d.ts.map

package/dist/lib/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/lib/validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;QAC7C,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACpB,CAAC;IACF,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAGD;;GAEG;AACH,qBAAa,SAAS;IACpB;;OAEG;IACH,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG;QACjC,KAAK,EAAE,OAAO,CAAC;QACf,IAAI,CAAC,EAAE,kBAAkB,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB;IAmDD;;;OAGG;IACH,gBAAgB,CAAC,QAAQ,EAAE,GAAG,GAAG,MAAM,EAAE;IA2BzC;;;;;;;;;OASG;IACH,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;CAwCtC"}