@zerotal/validator 1.7.0 → 1.7.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerotal/validator",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "license": "MIT",
   "maturity": "stable",
   "private": false,
@@ -30,7 +30,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@zerotal/core": "1.7.0"
+    "@zerotal/core": "1.7.2"
   },
   "devDependencies": {
     "typescript": "^5.8.0"

package/src/FormRequest.ts

@@ -113,6 +113,30 @@ export abstract class FormRequest {
     throw new Error(`${this.constructor.name}.rules() is not implemented.`);
   }
 
+  /**
+   * Normalise the raw body before the rules see it. Default: unchanged.
+   *
+   * This is where the shape of the *transport* gets reconciled with the shape of
+   * the rules. An HTML form has no way to say `null`: an unselected `<select>`
+   * posts `""`, so a `r.number().nullable()` field fails on the one input the
+   * browser can actually produce for "nothing". A client-side form can patch
+   * that up before it posts; a plain `<form method="post">` cannot, and a rule
+   * only reachable from a build with JavaScript is not a shared rule.
+   *
+   * Runs after `authorize()` and after the body is parsed, so it sees exactly
+   * what arrived. Return the object to validate — mutating and returning the
+   * argument is fine.
+   *
+   * @example
+   * override prepareForValidation(body: Record<string, unknown>) {
+   *   if (body["assigneeId"] === "") body["assigneeId"] = null;
+   *   return body;
+   * }
+   */
+  prepareForValidation(body: Record<string, unknown>): Record<string, unknown> {
+    return body;
+  }
+
   /**
    * Attach a helper method to all FormRequest instances at runtime.
    * Designed for framework packages (e.g. @zerotal/auth) that expose
@@ -193,6 +217,10 @@ export abstract class FormRequest {
       schema[key] = rule._def;
     }
 
+    // The transport's shape reconciled with the rules' shape, before the rules
+    // run. See `prepareForValidation` for why an HTML form needs this at all.
+    body = instance.prepareForValidation(body);
+
     const result = await runValidationAsync(schema as Schema, body);
     const session = (ctx as unknown as { session?: SessionLike }).session;
 

package/src/Validator.ts

@@ -135,7 +135,17 @@ export function runValidation<S extends Schema>(
       continue;
     }
 
-    if (!isRequired && (value === undefined || value === null)) {
+    // Absent → skipped, which is what `optional()` means. An explicit `null` on
+    // a field that also declared `nullable()` is *not* absence: it is someone
+    // saying "clear this", and it falls through to the branch below so it
+    // reaches the output. Without this, `optional().nullable()` silently drops
+    // the null, `fill()` sees `undefined`, and "unassign" saves nothing while
+    // reporting success.
+    //
+    // `null` on a field that is optional but *not* nullable keeps the old
+    // behaviour — skipped rather than an error — so this widens what survives
+    // validation without newly rejecting anything.
+    if (!isRequired && (value === undefined || (value === null && !def.nullable))) {
       continue;
     }