@naturalcycles/backend-lib 9.43.0 → 9.44.0

package/dist/validation/ajv/ajvValidateRequest.js

@@ -1,9 +1,8 @@
-import { _deepCopy } from '@naturalcycles/js-lib/object';
 import { AjvSchema, getCoercingAjv, } from '@naturalcycles/nodejs-lib/ajv';
 import { handleValidationError } from '../validateRequest.util.js';
 class AjvValidateRequest {
     body(req, schema, opt = {}) {
-        return this.validate(req, 'body', schema, opt);
+        return this.validate(req, 'body', schema, req.rawBody ? () => JSON.parse(req.rawBody.toString()) : undefined, opt);
     }
     /**
      * Query validation uses type coercion (unlike body validation),
@@ -12,7 +11,11 @@ class AjvValidateRequest {
      * Coercion mutates the input, even if the end result is that the input failed the validation.
      */
     query(req, schema, opt = {}) {
-        return this.validate(req, 'query', schema, { coerceTypes: true, ...opt });
+        const originalQuery = JSON.stringify(req.query);
+        return this.validate(req, 'query', schema, () => JSON.parse(originalQuery), {
+            coerceTypes: true,
+            ...opt,
+        });
     }
     /**
      * Params validation uses type coercion (unlike body validation),
@@ -21,7 +24,11 @@ class AjvValidateRequest {
      * Coercion mutates the input, even if the end result is that the input failed the validation.
      */
     params(req, schema, opt = {}) {
-        return this.validate(req, 'params', schema, { coerceTypes: true, ...opt });
+        const originalParams = JSON.stringify(req.params);
+        return this.validate(req, 'params', schema, () => JSON.parse(originalParams), {
+            coerceTypes: true,
+            ...opt,
+        });
     }
     /**
      * Does NOT mutate `req.headers`,
@@ -32,18 +39,20 @@ class AjvValidateRequest {
      * there may be additional consumers for `req.headers` (e.g middlewares, etc).
      */
     headers(req, schema, opt = {}) {
-        const originalHeaders = _deepCopy(req.headers);
-        const headers = this.validate(req, 'headers', schema, opt);
-        req.headers = originalHeaders;
-        return headers;
+        return this.validate(req, 'headers', schema, undefined, {
+            mutateInput: false,
+            ...opt,
+        });
     }
-    validate(req, reqProperty, schema, opt = {}) {
+    validate(req, reqProperty, schema, getOriginalInput, opt = {}) {
         const input = req[reqProperty] || {};
-        const { coerceTypes } = opt;
+        const { coerceTypes, mutateInput } = opt;
         const ajv = coerceTypes ? getCoercingAjv() : undefined;
         const ajvSchema = AjvSchema.create(schema, { ajv });
         const [error, output] = ajvSchema.getValidationResult(input, {
             inputName: `request.${reqProperty}`,
+            getOriginalInput,
+            mutateInput,
         });
         if (error) {
             handleValidationError(error, input, opt);

package/dist/validation/validateRequest.util.d.ts

@@ -20,4 +20,14 @@ export interface ReqValidationOptions<ERR extends AppError> {
      * typically: request path params and request query params.
      */
     coerceTypes?: boolean;
+    /**
+     * Default value depends on the implementation and the object.
+     * Joi and Zod do not mutate input (even if you pass `mutateInput: true` - that feature is not supported).
+     * AJV by default does mutate the input, but depending on the property:
+     *
+     * body - will be mutated, by req.rawBody will be used (if available) for error message snippet
+     * params, query - will NOT mutate by default (unless you pass `mutateInput: true`)
+     * headers - will NOT mutate by default
+     */
+    mutateInput?: boolean;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@naturalcycles/backend-lib",
   "type": "module",
-  "version": "9.43.0",
+  "version": "9.44.0",
   "peerDependencies": {
     "@sentry/node": "^10"
   },

package/src/validation/ajv/ajvValidateRequest.ts

@@ -1,4 +1,3 @@
-import { _deepCopy } from '@naturalcycles/js-lib/object'
 import {
   AjvSchema,
   type AjvValidationError,
@@ -14,7 +13,13 @@ class AjvValidateRequest {
     schema: SchemaHandledByAjv<IN, OUT>,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
-    return this.validate(req, 'body', schema, opt)
+    return this.validate(
+      req,
+      'body',
+      schema,
+      req.rawBody ? () => JSON.parse(req.rawBody!.toString()) : undefined,
+      opt,
+    )
   }
 
   /**
@@ -28,7 +33,11 @@ class AjvValidateRequest {
     schema: SchemaHandledByAjv<IN, OUT>,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
-    return this.validate(req, 'query', schema, { coerceTypes: true, ...opt })
+    const originalQuery = JSON.stringify(req.query)
+    return this.validate(req, 'query', schema, () => JSON.parse(originalQuery), {
+      coerceTypes: true,
+      ...opt,
+    })
   }
 
   /**
@@ -42,7 +51,11 @@ class AjvValidateRequest {
     schema: SchemaHandledByAjv<IN, OUT>,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
-    return this.validate(req, 'params', schema, { coerceTypes: true, ...opt })
+    const originalParams = JSON.stringify(req.params)
+    return this.validate(req, 'params', schema, () => JSON.parse(originalParams), {
+      coerceTypes: true,
+      ...opt,
+    })
   }
 
   /**
@@ -58,26 +71,29 @@ class AjvValidateRequest {
     schema: SchemaHandledByAjv<IN, OUT>,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
-    const originalHeaders = _deepCopy(req.headers)
-    const headers = this.validate(req, 'headers', schema, opt)
-    req.headers = originalHeaders
-    return headers
+    return this.validate(req, 'headers', schema, undefined, {
+      mutateInput: false,
+      ...opt,
+    })
   }
 
   private validate<IN, OUT>(
     req: BackendRequest,
     reqProperty: 'body' | 'params' | 'query' | 'headers',
     schema: SchemaHandledByAjv<IN, OUT>,
+    getOriginalInput?: () => IN,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
     const input: IN = req[reqProperty] || {}
 
-    const { coerceTypes } = opt
+    const { coerceTypes, mutateInput } = opt
     const ajv = coerceTypes ? getCoercingAjv() : undefined
     const ajvSchema = AjvSchema.create(schema, { ajv })
 
     const [error, output] = ajvSchema.getValidationResult(input, {
       inputName: `request.${reqProperty}`,
+      getOriginalInput,
+      mutateInput,
     })
 
     if (error) {

package/src/validation/validateRequest.util.ts

@@ -69,4 +69,15 @@ export interface ReqValidationOptions<ERR extends AppError> {
    * typically: request path params and request query params.
    */
   coerceTypes?: boolean
+
+  /**
+   * Default value depends on the implementation and the object.
+   * Joi and Zod do not mutate input (even if you pass `mutateInput: true` - that feature is not supported).
+   * AJV by default does mutate the input, but depending on the property:
+   *
+   * body - will be mutated, by req.rawBody will be used (if available) for error message snippet
+   * params, query - will NOT mutate by default (unless you pass `mutateInput: true`)
+   * headers - will NOT mutate by default
+   */
+  mutateInput?: boolean
 }