@rvoh/psychic 3.8.2 → 3.8.5

package/dist/cjs/src/openapi-renderer/defaults.js

@@ -94,17 +94,6 @@ export const DEFAULT_OPENAPI_COMPONENT_RESPONSES = {
     Conflict: {
         description: 'The request failed because a conflict was detected with the given request params',
     },
-    // 422
-    ValidationErrors: {
-        description: 'The request failed to process due to validation errors with the provided values',
-        content: {
-            'application/json': {
-                schema: {
-                    $ref: '#/components/schemas/ValidationErrors',
-                },
-            },
-        },
-    },
     // 500
     InternalServerError: {
         description: 'the server encountered an unexpected condition that prevented it from fulfilling the request',

package/dist/cjs/src/router/index.js

@@ -224,16 +224,14 @@ suggested fix:  "${convertRouteParams(path)}"
     }
     /**
      * Automatically rescue certain errors and convert them into status codes.
-     * Validation errors (OpenAPI or otherwise) are by default converted to
-     * 400. 422 MUST ONLY be returned when accompanied by a ValidationErrors
-     * payload (even if the errors object is empty) that is intended to be displayed
-     * to the end user to indicate fields that must be corrected to be
-     * accepted.
+     * Validation errors (OpenAPI or otherwise) are converted to 400. When a
+     * controller deliberately returns field-level validation details for display
+     * to an end user, prefer a 400 response carrying an errors payload in the
+     * same shape as Dream#errors: { errors: { field: ['message'] } }.
      *
-     * Philosophy: do not return information (even difference between 400 & 422)
-     * unless it is explicitly intended for that information to be used to enable
-     * a front end interface to display information to support user-visible
-     * validation (e.g. an email must be formatted correctly).
+     * Philosophy: do not return information unless it is explicitly intended for
+     * that information to be used by a front-end interface supporting
+     * user-visible validation (e.g. an email must be formatted correctly).
      *
      * By default, do not provide an attacker with any visibility into which layer
      * of the application rejected their request.

package/dist/cjs/src/server/params.js

@@ -162,6 +162,8 @@ export default class Params {
         return this;
     }
     cast(paramName, paramValue, expectedType, opts) {
+        if (typeof paramValue === 'string')
+            paramValue = paramValue.trim();
         if (expectedType instanceof RegExp) {
             return this.matchRegexOrThrow(paramName, paramValue, expectedType);
         }

package/dist/esm/src/openapi-renderer/defaults.js

@@ -94,17 +94,6 @@ export const DEFAULT_OPENAPI_COMPONENT_RESPONSES = {
     Conflict: {
         description: 'The request failed because a conflict was detected with the given request params',
     },
-    // 422
-    ValidationErrors: {
-        description: 'The request failed to process due to validation errors with the provided values',
-        content: {
-            'application/json': {
-                schema: {
-                    $ref: '#/components/schemas/ValidationErrors',
-                },
-            },
-        },
-    },
     // 500
     InternalServerError: {
         description: 'the server encountered an unexpected condition that prevented it from fulfilling the request',

package/dist/esm/src/router/index.js

@@ -224,16 +224,14 @@ suggested fix:  "${convertRouteParams(path)}"
     }
     /**
      * Automatically rescue certain errors and convert them into status codes.
-     * Validation errors (OpenAPI or otherwise) are by default converted to
-     * 400. 422 MUST ONLY be returned when accompanied by a ValidationErrors
-     * payload (even if the errors object is empty) that is intended to be displayed
-     * to the end user to indicate fields that must be corrected to be
-     * accepted.
+     * Validation errors (OpenAPI or otherwise) are converted to 400. When a
+     * controller deliberately returns field-level validation details for display
+     * to an end user, prefer a 400 response carrying an errors payload in the
+     * same shape as Dream#errors: { errors: { field: ['message'] } }.
      *
-     * Philosophy: do not return information (even difference between 400 & 422)
-     * unless it is explicitly intended for that information to be used to enable
-     * a front end interface to display information to support user-visible
-     * validation (e.g. an email must be formatted correctly).
+     * Philosophy: do not return information unless it is explicitly intended for
+     * that information to be used by a front-end interface supporting
+     * user-visible validation (e.g. an email must be formatted correctly).
      *
      * By default, do not provide an attacker with any visibility into which layer
      * of the application rejected their request.

package/dist/esm/src/server/params.js

@@ -162,6 +162,8 @@ export default class Params {
         return this;
     }
     cast(paramName, paramValue, expectedType, opts) {
+        if (typeof paramValue === 'string')
+            paramValue = paramValue.trim();
         if (expectedType instanceof RegExp) {
             return this.matchRegexOrThrow(paramName, paramValue, expectedType);
         }

package/dist/types/src/router/index.d.ts

@@ -49,16 +49,14 @@ export default class PsychicRouter {
     private get validationErrorLoggingEnabled();
     /**
      * Automatically rescue certain errors and convert them into status codes.
-     * Validation errors (OpenAPI or otherwise) are by default converted to
-     * 400. 422 MUST ONLY be returned when accompanied by a ValidationErrors
-     * payload (even if the errors object is empty) that is intended to be displayed
-     * to the end user to indicate fields that must be corrected to be
-     * accepted.
+     * Validation errors (OpenAPI or otherwise) are converted to 400. When a
+     * controller deliberately returns field-level validation details for display
+     * to an end user, prefer a 400 response carrying an errors payload in the
+     * same shape as Dream#errors: { errors: { field: ['message'] } }.
      *
-     * Philosophy: do not return information (even difference between 400 & 422)
-     * unless it is explicitly intended for that information to be used to enable
-     * a front end interface to display information to support user-visible
-     * validation (e.g. an email must be formatted correctly).
+     * Philosophy: do not return information unless it is explicitly intended for
+     * that information to be used by a front-end interface supporting
+     * user-visible validation (e.g. an email must be formatted correctly).
      *
      * By default, do not provide an attacker with any visibility into which layer
      * of the application rejected their request.

package/package.json

@@ -2,7 +2,7 @@
   "type": "module",
   "name": "@rvoh/psychic",
   "description": "Typescript web framework",
-  "version": "3.8.2",
+  "version": "3.8.5",
   "author": "RVOHealth",
   "publishConfig": {
     "access": "public"
@@ -137,5 +137,5 @@
     "vitest": "^4.1.0",
     "winston": "^3.14.2"
   },
-  "packageManager": "pnpm@11.1.3+sha512.c85357fe17ca12dd23dd7071822666dfd7e3cb76fe214e3370b5ea2fb34f2a231185509b63e717f3cd0acb38dd3f8d82bcd5e8172400ae678b70ea4fbed0896d"
+  "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b"
 }