@plutocms/supabase 0.8.3 → 0.8.4

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.8.4](https://github.com/plutocms/supabase/compare/v0.8.3...v0.8.4) (2026-09-14)
+
+
+### Bug Fixes
+
+* **security:** validate request bodies with zod ([#69](https://github.com/plutocms/supabase/issues/69)) ([94f179b](https://github.com/plutocms/supabase/commit/94f179bbfdd67a55c18764a5bf6fde0cc6635936))
+
 ## [0.8.3](https://github.com/plutocms/supabase/compare/v0.8.2...v0.8.3) (2026-09-13)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@plutocms/supabase",
   "type": "module",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "trustedDependencies": [
     "@parcel/watcher",
     "@plutocms/pluto",
@@ -42,7 +42,8 @@
     "@plutocms/pluto": "^0.10.0",
     "@plutocms/utils": "^0.2.1",
     "postgres": "^3.4.9",
-    "supabase": "^2.109.1"
+    "supabase": "^2.109.1",
+    "zod": "^4.6.4"
   },
   "devDependencies": {
     "@antfu/eslint-config": "^6.2.0",

package/server/api/auth/signup.post.ts

@@ -1,23 +1,22 @@
 import { serverSupabaseClient } from '#supabase/server'
+import { z } from 'zod'
+import { parseBody } from '../../utils/validate'
 
-interface Payload {
-  username: string
-  display_name: string
-  email: string
-  password: string
-}
+// Supabase Auth (GoTrue) rejects a password under 6 characters with its own
+// opaque error. Matching that minimum here turns an empty/short password
+// into the same clean 400 shape as every other validation failure, instead
+// of a raw auth-service error reaching the caller.
+const signupSchema = z.object({
+  username: z.string().trim().min(3, 'Username must be at least 3 characters.').max(100),
+  display_name: z.string().trim().min(1, 'Display name is required.').max(200),
+  email: z.string().trim().email('Email must be a valid email address.'),
+  password: z.string().min(6, 'Password must be at least 6 characters.'),
+})
 
 export default defineEventHandler(async (event) => {
   const client = await serverSupabaseClient<Database>(event)
 
-  const body = await readBody<Payload>(event)
-
-  if (!body.username || body.username.length < 3) {
-    return {
-      success: false,
-      message: 'Username must be at least 3 characters.',
-    }
-  }
+  const body = await parseBody(event, signupSchema)
 
   const { data, error } = await client.auth.signUp({
     email: body.email,

package/server/api/migrations/run.post.ts

@@ -1,14 +1,20 @@
 import type { PlutoMigrationFile } from '../../../shared/types/migrations'
 import type { MigrationFileResult } from '../../utils/migrations'
+import { z } from 'zod'
 import { requireAdmin } from '../../utils/admin-guard'
 import { persistDatabaseUrl } from '../../utils/env-file'
 import { resolveConnectionString, runPendingMigrations } from '../../utils/migrations'
 import { scrubConnectionString } from '../../utils/scrub-connection-string'
 import { regenerateSupabaseTypes } from '../../utils/typegen'
+import { parseBody } from '../../utils/validate'
 
-interface Payload {
-  connectionString?: string
-}
+// The whole body is optional: an already-configured DATABASE_URL means the
+// caller need not (and, per resolveConnectionString, cannot) supply one.
+const runMigrationsSchema = z
+  .object({
+    connectionString: z.string().trim().min(1, 'Connection string must not be empty.').optional(),
+  })
+  .optional()
 
 export default defineEventHandler(async (event) => {
   // requireAdmin specifically, not a named capability — see admin-guard.ts
@@ -16,7 +22,7 @@ export default defineEventHandler(async (event) => {
   // (which defines the capability system) has been applied.
   await requireAdmin(event)
 
-  const body = await readBody<Payload | undefined>(event)
+  const body = await parseBody(event, runMigrationsSchema)
 
   // Connection string precedence: an already-configured DATABASE_URL always
   // wins, and a body-supplied string is ignored completely in that case.

package/server/api/settings/update.post.ts

@@ -1,5 +1,7 @@
 import { serverSupabaseClient } from '#supabase/server'
+import { z } from 'zod'
 import { requireCapability } from '../../utils/capability-guard'
+import { parseBody } from '../../utils/validate'
 
 // A key is lowercase segments separated by dots, e.g. 'website_title' or
 // 'blog.posts_per_page'. Mirrors the settings_setting_key_format check
@@ -10,43 +12,26 @@ import { requireCapability } from '../../utils/capability-guard'
 const SETTING_KEY_PATTERN = /^[a-z0-9_]+(?:\.[a-z0-9_]+)*$/
 const MAX_SETTING_VALUE_LENGTH = 10_000
 
+const settingsUpdateSchema = z.record(
+  z
+    .string()
+    .regex(
+      SETTING_KEY_PATTERN,
+      'Setting key must use lowercase letters, digits, underscores, and dot-separated segments.'
+    ),
+  z.string().max(MAX_SETTING_VALUE_LENGTH, 'Setting value is too long.')
+)
+
 export default defineEventHandler(async (event) => {
   await requireCapability(event, 'settings:manage')
 
   const client = await serverSupabaseClient<Database>(event)
-  const body = await readBody<Record<string, unknown>>(event)
-
-  if (!body || typeof body !== 'object') {
-    throw createError({ statusCode: 400, statusMessage: 'No payload sent.' })
-  }
-
-  const transformed = Object.entries(body).map(([key, value]) => {
-    if (!SETTING_KEY_PATTERN.test(key)) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: `Invalid setting key: ${key}`,
-      })
-    }
-
-    if (typeof value !== 'string') {
-      throw createError({
-        statusCode: 400,
-        statusMessage: `Setting "${key}" must be a string.`,
-      })
-    }
-
-    if (value.length > MAX_SETTING_VALUE_LENGTH) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: `Setting "${key}" is too long.`,
-      })
-    }
+  const body = await parseBody(event, settingsUpdateSchema)
 
-    return {
-      setting_key: key,
-      setting_value: value,
-    }
-  })
+  const transformed = Object.entries(body).map(([key, value]) => ({
+    setting_key: key,
+    setting_value: value,
+  }))
 
   const { data, error } = await client
     .from('settings')

package/server/api/setup/create.post.ts

@@ -1,12 +1,18 @@
 import type { PlutoMigrationFile } from '../../../shared/types/migrations'
 import postgres from 'postgres'
+import { z } from 'zod'
 import { persistDatabaseUrl } from '../../utils/env-file'
 import { runPendingMigrations } from '../../utils/migrations'
 import { scrubConnectionString } from '../../utils/scrub-connection-string'
-
-interface Payload {
-  connectionString: string
-}
+import { parseBody } from '../../utils/validate'
+
+// Only checks that a connection string was actually sent. A Postgres
+// connection string can take many valid forms (postgres:// URL, key=value
+// DSN, and so on), so this route's real security model is the
+// DATABASE_URL precedence check above, not a stricter format check here.
+const setupSchema = z.object({
+  connectionString: z.string().trim().min(1, 'Connection string must not be empty.'),
+})
 
 export default defineEventHandler(async (event) => {
   // An already-configured DATABASE_URL means setup has already completed.
@@ -23,7 +29,7 @@ export default defineEventHandler(async (event) => {
     })
   }
 
-  const body = await readBody<Payload>(event)
+  const body = await parseBody(event, setupSchema)
 
   const config = useRuntimeConfig()
   // Nuxt's schema inference narrows `plutoLayerMigrations` to whatever

package/server/utils/validate.ts

@@ -0,0 +1,44 @@
+import type { H3Event } from 'h3'
+import type { ZodSchema } from 'zod'
+
+/**
+ * One field-level validation error.
+ *
+ * Matches `ContentValidationError` from `@plutocms/pluto`'s
+ * `shared/utils/content-validate.ts`, so a zod failure and a content-model
+ * failure look the same to a caller.
+ */
+export interface ValidationError {
+  field: string
+  message: string
+}
+
+/**
+ * Reads a request body and checks it against a zod schema.
+ *
+ * On success, returns the parsed, typed body. On failure, throws the same
+ * 400 shape `@plutocms/pluto`'s generic content routes throw for a content
+ * validation failure: `{ statusCode: 400, statusMessage: 'Validation
+ * failed.', data: { errors } }`, with `errors` as `{ field, message }[]`.
+ * Every route in this workspace should call this helper instead of
+ * hand-rolling its own zod error handling, so a malformed request fails
+ * the same way everywhere.
+ *
+ * A nested field path (for example `address.zip`) is joined with `.` to
+ * build `field`.
+ */
+export async function parseBody<T>(event: H3Event, schema: ZodSchema<T>): Promise<T> {
+  const body = await readBody(event)
+  const result = schema.safeParse(body)
+
+  if (!result.success) {
+    const errors: ValidationError[] = result.error.issues.map((issue) => ({
+      field: issue.path.join('.'),
+      message: issue.message,
+    }))
+
+    throw createError({ statusCode: 400, statusMessage: 'Validation failed.', data: { errors } })
+  }
+
+  return result.data
+}