@tahminator/sapling 1.5.28-beta.01a8d6cf → 1.5.28-beta.03ae0bff

package/README.md

@@ -19,6 +19,7 @@ A lightweight Express.js dependency injection & route abstraction library.
   * [Responses](#responses)
   * [Error Handling](#error-handling)
   * [Middleware](#middleware)
+  * [Request Validation](#request-validation)
   * [Redirects](#redirects)
   * [Dependency Injection](#dependency-injection)
   * [Custom Serialization](#custom-serialization)
@@ -142,8 +143,11 @@ Sapling supports the usual suspects:
 - `@DELETE(path?)`
 - `@PATCH(path?)`
 - `@Middleware(path?)` - for middleware
+- `@RequestBody(schema)` - validate & parse the request body
+- `@RequestParam(schema)` - validate & parse route params
+- `@RequestQuery(schema)` - validate & parse the query string
 
-Path defaults to `"/"` if you don't pass one.
+Path defaults to `"/"` if you don't pass one. The request schema decorators accept any [Standard Schema](https://github.com/standard-schema/standard-schema) compatible validator (e.g. Zod, Valibot, ArkType).
 
 ### Responses
 
@@ -234,6 +238,56 @@ app.use(Sapling.resolve(CookieParserMiddleware));
 app.use(cookieParser());
 ```
 
+### Request Validation
+
+Validate and transform request bodies, route params, and query strings at the controller level using `@RequestBody`, `@RequestParam`, and `@RequestQuery`. These decorators accept any [Standard Schema](https://github.com/standard-schema/standard-schema) compatible validator (Zod, Valibot, ArkType, etc.).
+
+If validation fails, a `ParserError` is thrown, which Express handles as a `400 Bad Request` by default:
+
+```typescript
+import { z } from "zod";
+
+const CreateUserSchema = z.object({ name: z.string(), age: z.number() });
+const UserParamsSchema = z.object({ id: z.string() });
+const ListUsersQuerySchema = z.object({ page: z.coerce.number() });
+
+@Controller({ prefix: "/users" })
+class UserController {
+  @RequestBody(CreateUserSchema)
+  @POST()
+  createUser(request: Request): ResponseEntity<User> {
+    // request.body has been fully validated and rewritten. you can safely assert the type!
+    const requestBody = request.body as unknown as z.infer<CreateUserSchema>;
+  
+    const user = this.database.user.create(requestBody.name, requestBody.age)
+
+    return ResponseEntity.ok().body(user);
+  }
+
+  @RequestParam(UserParamsSchema)
+  @GET("/:id")
+  getUser(request: Request): ResponseEntity<z.infer<typeof UserParamsSchema>> {
+    // request.params has been fully validated and rewritten. you can safely assert the type!
+    const params = request.params as unknown as z.infer<typeof UserParamsSchema>;
+
+    const user = this.database.user.findById(params.id);
+
+    return ResponseEntity.ok().body(user);
+  }
+
+  @RequestQuery(ListUsersQuerySchema)
+  @GET()
+  listUsers(request: Request): ResponseEntity<z.infer<typeof ListUsersQuerySchema>> {
+    // request.query has been fully validated and rewritten. you can safely assert the type!
+    const query = request.query as unknown as z.infer<typeof ListUsersQuerySchema>;
+
+    const users = this.database.user.findAll({ page: query.page });
+
+    return ResponseEntity.ok().body(users);
+  }
+}
+```
+
 ### Redirects
 
 ```typescript

package/dist/index.cjs

@@ -310,34 +310,6 @@ var Sapling = class Sapling {
 		app.use(Sapling.json());
 	}
 	/**
-	* Register a middleware that will handle {@link ResponseStatusError}.
-	*
-	* This middleware will chain to the next middleware if it does not catch {@link ResponseStatusError}.
-	* You may still define middleware to handle all other errors in a separate `app.use` call.
-	*
-	* @example
-	* ```ts
-	* import express from "express";
-	* import { Sapling } from "@tahminator/sapling";
-	*
-	* const app = express();
-	*
-	* Sapling.loadResponseStatusErrorMiddleware(app, (err, req, res, next) => {
-	*   // `err` is guaranteed to be of type ResponseStatusError
-	*   res.status(err.status).json({
-	*     success: false,
-	*     message: err.message,
-	*   });
-	* });
-	* ```
-	*/
-	static loadResponseStatusErrorMiddleware(app, fn) {
-		app.use(((err, req, res, next) => {
-			if (err instanceof ResponseStatusError) fn(err, req, res, next);
-			else next(err);
-		}));
-	}
-	/**
 	* Serialize a value into a JSON string.
 	*
 	* This function is used in {@link ResponseEntity} to serialize the `body`.
@@ -678,6 +650,14 @@ function Controller({ prefix = "", deps = [] } = {}) {
 		const usedRoutes = /* @__PURE__ */ new Set();
 		_InjectableDeps.set(targetClass, deps);
 		const controllerInstance = _resolve(targetClass);
+		if (routes.reduce((prev, r) => {
+			if (r.method !== "USE") return prev;
+			const fn = controllerInstance[r.fnName];
+			return typeof fn === "function" && fn.length >= 4 ? prev + 1 : prev;
+		}, 0) > 1) throw new Error(`Invalid @MiddlewareClass class "${targetClass.name}":
+Multiple 4-arg @Middleware() error handlers were found.
+Express will not enter routers in error mode, so an error-middleware class must expose exactly one error handler.
+Split these into separate @MiddlewareClass classes, or merge the logic into a single method.`);
 		for (const { method, path, fnName } of routes) {
 			const fn = controllerInstance[fnName];
 			if (typeof fn !== "function") continue;
@@ -686,6 +666,26 @@ function Controller({ prefix = "", deps = [] } = {}) {
 			if (method !== "USE" && usedRoutes.has(routeKey)) throw new Error(`Duplicate route [${method}] "${path instanceof RegExp ? path.source : fp}" detected in controller "${target.name}"`);
 			if (method !== "USE") usedRoutes.add(routeKey);
 			const methodName = methodResolve[method];
+			if (method === "USE" && fn.length >= 4) {
+				const middlewareFn = async (err, request, response, next) => {
+					try {
+						const result = fn.bind(controllerInstance)(err, request, response, next);
+						if (result instanceof ResponseEntity) {
+							response.contentType("application/json").status(result.getStatusCode()).set(result.getHeaders()).send(Sapling.serialize(result.getBody()));
+							return;
+						}
+						if (result instanceof RedirectView) {
+							response.redirect(result.getUrl());
+							return;
+						}
+					} catch (e) {
+						console.error(e);
+						next(e);
+					}
+				};
+				_ControllerRegistry.set(targetClass, middlewareFn);
+				return;
+			}
 			router[methodName](fp, async (request, response, next) => {
 				const schemas = _getRequestSchemas(target, fnName);
 				if (schemas) {
@@ -694,7 +694,6 @@ function Controller({ prefix = "", deps = [] } = {}) {
 					if (schemas.query) request.query = await _parseOrThrow(schemas.query, request.query, "reqquery");
 				}
 				const result = await fn.bind(controllerInstance)(request, response, next);
-				if (method === "USE") return;
 				if (result instanceof ResponseEntity) {
 					response.contentType("application/json").status(result.getStatusCode()).set(result.getHeaders()).send(Sapling.serialize(result.getBody()));
 					return;
@@ -703,7 +702,7 @@ function Controller({ prefix = "", deps = [] } = {}) {
 					response.redirect(result.getUrl());
 					return;
 				}
-				if (!response.writableEnded) response.status(404).send(Html404ErrorPage(`Cannot ${methodName.toUpperCase()} ${path instanceof RegExp ? path.source : fp}`));
+				if (method !== "USE" && !response.writableEnded) response.status(404).send(Html404ErrorPage(`Cannot ${methodName.toUpperCase()} ${path instanceof RegExp ? path.source : fp}`));
 			});
 		}
 		_ControllerRegistry.set(targetClass, router);

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import e, { NextFunction, Request, Response, Router } from "express";
+import e, { ErrorRequestHandler, NextFunction, Request, Response, Router } from "express";
 
 //#region src/html/404.d.ts
 /**
@@ -29,7 +29,7 @@ type HttpHeaders = Record<string, string>;
 type ExpressMiddlewareFn = ($1: Request, $2: Response, $3: NextFunction) => void;
 //#endregion
 //#region src/annotation/controller.d.ts
-declare const _ControllerRegistry: WeakMap<Function, Router>;
+declare const _ControllerRegistry: WeakMap<Function, Router | ErrorRequestHandler>;
 type ControllerProps = {
   /**
    * Optional URL prefix applied to all routes in the controller. Defaults to "".
@@ -416,7 +416,7 @@ declare class Sapling {
    * app.use(router);
    * ```
    */
-  static resolve<TClass>(this: void, clazz: Class<TClass>): Router;
+  static resolve<TClass>(this: void, clazz: Class<TClass>): Router | ErrorRequestHandler;
   /**
    * Register this function as a middleware in order to utilize Sapling's `deserialize` function.
    *
@@ -443,29 +443,6 @@ declare class Sapling {
    * ```
    */
   static registerApp(app: e.Express): void;
-  /**
-   * Register a middleware that will handle {@link ResponseStatusError}.
-   *
-   * This middleware will chain to the next middleware if it does not catch {@link ResponseStatusError}.
-   * You may still define middleware to handle all other errors in a separate `app.use` call.
-   *
-   * @example
-   * ```ts
-   * import express from "express";
-   * import { Sapling } from "@tahminator/sapling";
-   *
-   * const app = express();
-   *
-   * Sapling.loadResponseStatusErrorMiddleware(app, (err, req, res, next) => {
-   *   // `err` is guaranteed to be of type ResponseStatusError
-   *   res.status(err.status).json({
-   *     success: false,
-   *     message: err.message,
-   *   });
-   * });
-   * ```
-   */
-  static loadResponseStatusErrorMiddleware(this: void, app: e.Express, fn: (err: ResponseStatusError, request: e.Request, response: e.Response, next: e.NextFunction) => void): void;
   /**
    * Serialize a value into a JSON string.
    *

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import e, { NextFunction, Request, Response, Router } from "express";
+import e, { ErrorRequestHandler, NextFunction, Request, Response, Router } from "express";
 
 //#region src/html/404.d.ts
 /**
@@ -29,7 +29,7 @@ type HttpHeaders = Record<string, string>;
 type ExpressMiddlewareFn = ($1: Request, $2: Response, $3: NextFunction) => void;
 //#endregion
 //#region src/annotation/controller.d.ts
-declare const _ControllerRegistry: WeakMap<Function, Router>;
+declare const _ControllerRegistry: WeakMap<Function, Router | ErrorRequestHandler>;
 type ControllerProps = {
   /**
    * Optional URL prefix applied to all routes in the controller. Defaults to "".
@@ -416,7 +416,7 @@ declare class Sapling {
    * app.use(router);
    * ```
    */
-  static resolve<TClass>(this: void, clazz: Class<TClass>): Router;
+  static resolve<TClass>(this: void, clazz: Class<TClass>): Router | ErrorRequestHandler;
   /**
    * Register this function as a middleware in order to utilize Sapling's `deserialize` function.
    *
@@ -443,29 +443,6 @@ declare class Sapling {
    * ```
    */
   static registerApp(app: e.Express): void;
-  /**
-   * Register a middleware that will handle {@link ResponseStatusError}.
-   *
-   * This middleware will chain to the next middleware if it does not catch {@link ResponseStatusError}.
-   * You may still define middleware to handle all other errors in a separate `app.use` call.
-   *
-   * @example
-   * ```ts
-   * import express from "express";
-   * import { Sapling } from "@tahminator/sapling";
-   *
-   * const app = express();
-   *
-   * Sapling.loadResponseStatusErrorMiddleware(app, (err, req, res, next) => {
-   *   // `err` is guaranteed to be of type ResponseStatusError
-   *   res.status(err.status).json({
-   *     success: false,
-   *     message: err.message,
-   *   });
-   * });
-   * ```
-   */
-  static loadResponseStatusErrorMiddleware(this: void, app: e.Express, fn: (err: ResponseStatusError, request: e.Request, response: e.Response, next: e.NextFunction) => void): void;
   /**
    * Serialize a value into a JSON string.
    *

package/dist/index.mjs

@@ -286,34 +286,6 @@ var Sapling = class Sapling {
 		app.use(Sapling.json());
 	}
 	/**
-	* Register a middleware that will handle {@link ResponseStatusError}.
-	*
-	* This middleware will chain to the next middleware if it does not catch {@link ResponseStatusError}.
-	* You may still define middleware to handle all other errors in a separate `app.use` call.
-	*
-	* @example
-	* ```ts
-	* import express from "express";
-	* import { Sapling } from "@tahminator/sapling";
-	*
-	* const app = express();
-	*
-	* Sapling.loadResponseStatusErrorMiddleware(app, (err, req, res, next) => {
-	*   // `err` is guaranteed to be of type ResponseStatusError
-	*   res.status(err.status).json({
-	*     success: false,
-	*     message: err.message,
-	*   });
-	* });
-	* ```
-	*/
-	static loadResponseStatusErrorMiddleware(app, fn) {
-		app.use(((err, req, res, next) => {
-			if (err instanceof ResponseStatusError) fn(err, req, res, next);
-			else next(err);
-		}));
-	}
-	/**
 	* Serialize a value into a JSON string.
 	*
 	* This function is used in {@link ResponseEntity} to serialize the `body`.
@@ -654,6 +626,14 @@ function Controller({ prefix = "", deps = [] } = {}) {
 		const usedRoutes = /* @__PURE__ */ new Set();
 		_InjectableDeps.set(targetClass, deps);
 		const controllerInstance = _resolve(targetClass);
+		if (routes.reduce((prev, r) => {
+			if (r.method !== "USE") return prev;
+			const fn = controllerInstance[r.fnName];
+			return typeof fn === "function" && fn.length >= 4 ? prev + 1 : prev;
+		}, 0) > 1) throw new Error(`Invalid @MiddlewareClass class "${targetClass.name}":
+Multiple 4-arg @Middleware() error handlers were found.
+Express will not enter routers in error mode, so an error-middleware class must expose exactly one error handler.
+Split these into separate @MiddlewareClass classes, or merge the logic into a single method.`);
 		for (const { method, path, fnName } of routes) {
 			const fn = controllerInstance[fnName];
 			if (typeof fn !== "function") continue;
@@ -662,6 +642,26 @@ function Controller({ prefix = "", deps = [] } = {}) {
 			if (method !== "USE" && usedRoutes.has(routeKey)) throw new Error(`Duplicate route [${method}] "${path instanceof RegExp ? path.source : fp}" detected in controller "${target.name}"`);
 			if (method !== "USE") usedRoutes.add(routeKey);
 			const methodName = methodResolve[method];
+			if (method === "USE" && fn.length >= 4) {
+				const middlewareFn = async (err, request, response, next) => {
+					try {
+						const result = fn.bind(controllerInstance)(err, request, response, next);
+						if (result instanceof ResponseEntity) {
+							response.contentType("application/json").status(result.getStatusCode()).set(result.getHeaders()).send(Sapling.serialize(result.getBody()));
+							return;
+						}
+						if (result instanceof RedirectView) {
+							response.redirect(result.getUrl());
+							return;
+						}
+					} catch (e) {
+						console.error(e);
+						next(e);
+					}
+				};
+				_ControllerRegistry.set(targetClass, middlewareFn);
+				return;
+			}
 			router[methodName](fp, async (request, response, next) => {
 				const schemas = _getRequestSchemas(target, fnName);
 				if (schemas) {
@@ -670,7 +670,6 @@ function Controller({ prefix = "", deps = [] } = {}) {
 					if (schemas.query) request.query = await _parseOrThrow(schemas.query, request.query, "reqquery");
 				}
 				const result = await fn.bind(controllerInstance)(request, response, next);
-				if (method === "USE") return;
 				if (result instanceof ResponseEntity) {
 					response.contentType("application/json").status(result.getStatusCode()).set(result.getHeaders()).send(Sapling.serialize(result.getBody()));
 					return;
@@ -679,7 +678,7 @@ function Controller({ prefix = "", deps = [] } = {}) {
 					response.redirect(result.getUrl());
 					return;
 				}
-				if (!response.writableEnded) response.status(404).send(Html404ErrorPage(`Cannot ${methodName.toUpperCase()} ${path instanceof RegExp ? path.source : fp}`));
+				if (method !== "USE" && !response.writableEnded) response.status(404).send(Html404ErrorPage(`Cannot ${methodName.toUpperCase()} ${path instanceof RegExp ? path.source : fp}`));
 			});
 		}
 		_ControllerRegistry.set(targetClass, router);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tahminator/sapling",
-  "version": "1.5.28-beta.01a8d6cf",
+  "version": "1.5.28-beta.03ae0bff",
   "author": "Tahmid Ahmed",
   "description": "A library to help you write cleaner Express.js code",
   "repository": {
@@ -56,7 +56,8 @@
     "tsdown": "^0.21.10",
     "typescript-eslint": "^8.57.2",
     "vite-tsconfig-paths": "^6.1.1",
-    "vitest": "^4.1.2"
+    "vitest": "^4.1.2",
+    "zod": "^4.4.3"
   },
   "inlinedDependencies": {
     "@standard-schema/spec": "1.1.0"