@naturalcycles/backend-lib 9.43.0 → 9.44.1

package/dist/server/server.model.d.ts

@@ -18,6 +18,11 @@ export interface BackendRequest extends Request {
      * Only used for request logging purposes.
      */
     userId?: string;
+    /**
+     * It's set to unknown (instead of `any`) to prevent implicit use of any
+     * in unexpected places.
+     */
+    body: unknown;
     /**
      * Raw Buffer of the `req.body`, before it's stringified and json-parsed.
      * Useful for when something mutates `req.body` json (e.g j validation), and you

package/dist/validation/ajv/ajvValidateRequest.js

@@ -1,9 +1,8 @@
-import { _deepCopy } from '@naturalcycles/js-lib/object';
 import { AjvSchema, getCoercingAjv, } from '@naturalcycles/nodejs-lib/ajv';
 import { handleValidationError } from '../validateRequest.util.js';
 class AjvValidateRequest {
     body(req, schema, opt = {}) {
-        return this.validate(req, 'body', schema, opt);
+        return this.validate(req, 'body', schema, req.rawBody ? () => JSON.parse(req.rawBody.toString()) : undefined, opt);
     }
     /**
      * Query validation uses type coercion (unlike body validation),
@@ -12,7 +11,11 @@ class AjvValidateRequest {
      * Coercion mutates the input, even if the end result is that the input failed the validation.
      */
     query(req, schema, opt = {}) {
-        return this.validate(req, 'query', schema, { coerceTypes: true, ...opt });
+        const originalQuery = JSON.stringify(req.query);
+        return this.validate(req, 'query', schema, () => JSON.parse(originalQuery), {
+            coerceTypes: true,
+            ...opt,
+        });
     }
     /**
      * Params validation uses type coercion (unlike body validation),
@@ -21,7 +24,11 @@ class AjvValidateRequest {
      * Coercion mutates the input, even if the end result is that the input failed the validation.
      */
     params(req, schema, opt = {}) {
-        return this.validate(req, 'params', schema, { coerceTypes: true, ...opt });
+        const originalParams = JSON.stringify(req.params);
+        return this.validate(req, 'params', schema, () => JSON.parse(originalParams), {
+            coerceTypes: true,
+            ...opt,
+        });
     }
     /**
      * Does NOT mutate `req.headers`,
@@ -32,18 +39,20 @@ class AjvValidateRequest {
      * there may be additional consumers for `req.headers` (e.g middlewares, etc).
      */
     headers(req, schema, opt = {}) {
-        const originalHeaders = _deepCopy(req.headers);
-        const headers = this.validate(req, 'headers', schema, opt);
-        req.headers = originalHeaders;
-        return headers;
+        return this.validate(req, 'headers', schema, undefined, {
+            mutateInput: false,
+            ...opt,
+        });
     }
-    validate(req, reqProperty, schema, opt = {}) {
-        const input = req[reqProperty] || {};
-        const { coerceTypes } = opt;
+    validate(req, reqProperty, schema, getOriginalInput, opt = {}) {
+        const input = (req[reqProperty] || {});
+        const { coerceTypes, mutateInput } = opt;
         const ajv = coerceTypes ? getCoercingAjv() : undefined;
         const ajvSchema = AjvSchema.create(schema, { ajv });
         const [error, output] = ajvSchema.getValidationResult(input, {
             inputName: `request.${reqProperty}`,
+            getOriginalInput,
+            mutateInput,
         });
         if (error) {
             handleValidationError(error, input, opt);

package/dist/validation/joi/joiValidateRequest.js

@@ -23,7 +23,7 @@ class ValidateRequest {
         return this.validate(req, 'headers', schema, opt);
     }
     validate(req, reqProperty, schema, opt = {}) {
-        const originalProperty = req[reqProperty] || {};
+        const originalProperty = (req[reqProperty] || {});
         // Joi does not mutate the input
         const [error, value] = getValidationResult(originalProperty, schema, `request.${reqProperty}`);
         if (error) {

package/dist/validation/validateRequest.util.d.ts

@@ -20,4 +20,14 @@ export interface ReqValidationOptions<ERR extends AppError> {
      * typically: request path params and request query params.
      */
     coerceTypes?: boolean;
+    /**
+     * Default value depends on the implementation and the object.
+     * Joi and Zod do not mutate input (even if you pass `mutateInput: true` - that feature is not supported).
+     * AJV by default does mutate the input, but depending on the property:
+     *
+     * body - will be mutated, by req.rawBody will be used (if available) for error message snippet
+     * params, query - will NOT mutate by default (unless you pass `mutateInput: true`)
+     * headers - will NOT mutate by default
+     */
+    mutateInput?: boolean;
 }

package/dist/validation/zod/zodValidateRequest.js

@@ -23,7 +23,7 @@ class ZodValidateRequest {
         return this.validate(req, 'headers', schema, opt);
     }
     validate(req, reqProperty, schema, opt = {}) {
-        const originalProperty = req[reqProperty] || {};
+        const originalProperty = (req[reqProperty] || {});
         // Zod does not mutate the input
         const [error, data] = zSafeValidate(originalProperty, schema);
         if (error) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@naturalcycles/backend-lib",
   "type": "module",
-  "version": "9.43.0",
+  "version": "9.44.1",
   "peerDependencies": {
     "@sentry/node": "^10"
   },
@@ -29,7 +29,7 @@
     "@sentry/node": "^10",
     "@types/ejs": "^3",
     "fastify": "^5",
-    "@naturalcycles/dev-lib": "18.4.2"
+    "@naturalcycles/dev-lib": "20.12.11"
   },
   "exports": {
     ".": "./dist/index.js",

package/src/server/server.model.ts

@@ -20,6 +20,13 @@ export interface BackendRequest extends Request {
    * Only used for request logging purposes.
    */
   userId?: string
+
+  /**
+   * It's set to unknown (instead of `any`) to prevent implicit use of any
+   * in unexpected places.
+   */
+  body: unknown
+
   /**
    * Raw Buffer of the `req.body`, before it's stringified and json-parsed.
    * Useful for when something mutates `req.body` json (e.g j validation), and you

package/src/validation/ajv/ajvValidateRequest.ts

@@ -1,4 +1,3 @@
-import { _deepCopy } from '@naturalcycles/js-lib/object'
 import {
   AjvSchema,
   type AjvValidationError,
@@ -14,7 +13,13 @@ class AjvValidateRequest {
     schema: SchemaHandledByAjv<IN, OUT>,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
-    return this.validate(req, 'body', schema, opt)
+    return this.validate(
+      req,
+      'body',
+      schema,
+      req.rawBody ? () => JSON.parse(req.rawBody!.toString()) : undefined,
+      opt,
+    )
   }
 
   /**
@@ -28,7 +33,11 @@ class AjvValidateRequest {
     schema: SchemaHandledByAjv<IN, OUT>,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
-    return this.validate(req, 'query', schema, { coerceTypes: true, ...opt })
+    const originalQuery = JSON.stringify(req.query)
+    return this.validate(req, 'query', schema, () => JSON.parse(originalQuery), {
+      coerceTypes: true,
+      ...opt,
+    })
   }
 
   /**
@@ -42,7 +51,11 @@ class AjvValidateRequest {
     schema: SchemaHandledByAjv<IN, OUT>,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
-    return this.validate(req, 'params', schema, { coerceTypes: true, ...opt })
+    const originalParams = JSON.stringify(req.params)
+    return this.validate(req, 'params', schema, () => JSON.parse(originalParams), {
+      coerceTypes: true,
+      ...opt,
+    })
   }
 
   /**
@@ -58,26 +71,29 @@ class AjvValidateRequest {
     schema: SchemaHandledByAjv<IN, OUT>,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
-    const originalHeaders = _deepCopy(req.headers)
-    const headers = this.validate(req, 'headers', schema, opt)
-    req.headers = originalHeaders
-    return headers
+    return this.validate(req, 'headers', schema, undefined, {
+      mutateInput: false,
+      ...opt,
+    })
   }
 
   private validate<IN, OUT>(
     req: BackendRequest,
     reqProperty: 'body' | 'params' | 'query' | 'headers',
     schema: SchemaHandledByAjv<IN, OUT>,
+    getOriginalInput?: () => IN,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
-    const input: IN = req[reqProperty] || {}
+    const input = (req[reqProperty] || {}) as IN
 
-    const { coerceTypes } = opt
+    const { coerceTypes, mutateInput } = opt
     const ajv = coerceTypes ? getCoercingAjv() : undefined
     const ajvSchema = AjvSchema.create(schema, { ajv })
 
     const [error, output] = ajvSchema.getValidationResult(input, {
       inputName: `request.${reqProperty}`,
+      getOriginalInput,
+      mutateInput,
     })
 
     if (error) {

package/src/validation/joi/joiValidateRequest.ts

@@ -51,7 +51,7 @@ class ValidateRequest {
     schema: AnySchema<T>,
     opt: ReqValidationOptions<JoiValidationError> = {},
   ): T {
-    const originalProperty = req[reqProperty] || {}
+    const originalProperty = (req[reqProperty] || {}) as T
 
     // Joi does not mutate the input
     const [error, value] = getValidationResult(originalProperty, schema, `request.${reqProperty}`)

package/src/validation/validateRequest.util.ts

@@ -69,4 +69,15 @@ export interface ReqValidationOptions<ERR extends AppError> {
    * typically: request path params and request query params.
    */
   coerceTypes?: boolean
+
+  /**
+   * Default value depends on the implementation and the object.
+   * Joi and Zod do not mutate input (even if you pass `mutateInput: true` - that feature is not supported).
+   * AJV by default does mutate the input, but depending on the property:
+   *
+   * body - will be mutated, by req.rawBody will be used (if available) for error message snippet
+   * params, query - will NOT mutate by default (unless you pass `mutateInput: true`)
+   * headers - will NOT mutate by default
+   */
+  mutateInput?: boolean
 }

package/src/validation/zod/zodValidateRequest.ts

@@ -50,7 +50,7 @@ class ZodValidateRequest {
     schema: ZodType<T>,
     opt: ReqValidationOptions<ZodValidationError> = {},
   ): T {
-    const originalProperty = req[reqProperty] || {}
+    const originalProperty = (req[reqProperty] || {}) as T
 
     // Zod does not mutate the input
     const [error, data] = zSafeValidate(