payment-kit 1.14.30 → 1.14.31

package/api/src/routes/payment-links.ts

@@ -4,7 +4,7 @@ import pick from 'lodash/pick';
 import { Op } from 'sequelize';
 import type { WhereOptions } from 'sequelize';
 
-import { createListParamSchema } from '../libs/api';
+import { createListParamSchema, MetadataSchema } from '../libs/api';
 import logger from '../libs/logger';
 import { authenticate } from '../libs/security';
 import { isLineItemAligned } from '../libs/session';
@@ -141,9 +141,62 @@ export async function createPaymentLink(payload: any) {
   return PaymentLink.create(raw as PaymentLink);
 }
 
-// FIXME: @wangshijun use schema validation
+const PaymentLinkCreateSchema = Joi.object({
+  name: Joi.string().required(),
+  line_items: Joi.array()
+    .items(
+      Joi.object({
+        price_id: Joi.string().required(),
+        quantity: Joi.number().min(1).required(),
+        adjustable_quantity: Joi.object({
+          enabled: Joi.boolean().required(),
+          minimum: Joi.number().min(0),
+          maximum: Joi.number().min(0),
+        })
+          .min(0)
+          .optional(),
+      })
+    )
+    .min(1)
+    .required(),
+  currency_id: Joi.string().optional(),
+  metadata: MetadataSchema,
+  after_completion: Joi.object({
+    type: Joi.string().valid('hosted_confirmation', 'redirect').required(),
+    hosted_confirmation: Joi.object({
+      custom_message: Joi.string().max(200).empty('').optional(),
+    })
+      .min(0)
+      .optional(),
+    redirect: Joi.object({
+      url: Joi.string().uri().max(2048).empty('').optional(),
+    })
+      .min(0)
+      .optional(),
+  })
+    .min(0)
+    .optional(),
+  allow_promotion_codes: Joi.boolean().optional(),
+  nft_mint_settings: Joi.object({
+    enabled: Joi.boolean().required(),
+    factory: Joi.string().max(40).empty('').optional(),
+  })
+    .min(0)
+    .optional(),
+  consent_collection: Joi.object({
+    promotions: Joi.string().valid('none', 'opt_in', 'opt_out').required(),
+    terms_of_service: Joi.string().valid('none', 'opt_in', 'opt_out').required(),
+  })
+    .min(0)
+    .optional(),
+}).unknown(true);
 router.post('/', auth, async (req, res) => {
   try {
+    const { error } = PaymentLinkCreateSchema.validate(req.body);
+    if (error) {
+      res.status(400).json({ error: `Payment link create request invalid: ${error.message}` });
+      return;
+    }
     const result = await createPaymentLink({
       ...req.body,
       livemode: !!req.livemode,
@@ -218,9 +271,58 @@ router.get('/:id', auth, async (req, res) => {
   }
 });
 
-// update
+const PaymentLinkUpdateSchema = Joi.object({
+  name: Joi.string().optional(),
+  line_items: Joi.array()
+    .items(
+      Joi.object({
+        price_id: Joi.string().required(),
+        quantity: Joi.number().min(1).required(),
+        adjustable_quantity: Joi.object({
+          enabled: Joi.boolean().required(),
+          minimum: Joi.number().min(0),
+          maximum: Joi.number().min(0),
+        })
+          .min(0)
+          .optional(),
+      })
+    )
+    .min(1)
+    .optional(),
+  currency_id: Joi.string().optional(),
+  metadata: MetadataSchema,
+  active: Joi.boolean().optional(),
+  after_completion: Joi.object({
+    type: Joi.string().valid('hosted_confirmation', 'redirect').optional(),
+    hosted_confirmation: Joi.object({
+      custom_message: Joi.string().max(200).empty('').optional(),
+    }),
+    redirect: Joi.object({
+      url: Joi.string().uri().max(2048).empty('').optional(),
+    }),
+  })
+    .min(0)
+    .optional(),
+  allow_promotion_codes: Joi.boolean().optional(),
+  nft_mint_settings: Joi.object({
+    enabled: Joi.boolean().required(),
+    factory: Joi.string().max(40).empty('').optional(),
+  })
+    .min(0)
+    .optional(),
+  consent_collection: Joi.object({
+    promotions: Joi.string().valid('none', 'opt_in', 'opt_out').optional(),
+    terms_of_service: Joi.string().valid('none', 'opt_in', 'opt_out').optional(),
+  })
+    .min(0)
+    .optional(),
+}).unknown(true);
 // eslint-disable-next-line consistent-return
 router.put('/:id', auth, async (req, res) => {
+  const { error } = PaymentLinkUpdateSchema.validate(req.body);
+  if (error) {
+    return res.status(400).json({ error: `Payment link update request invalid: ${error.message}` });
+  }
   const doc = await PaymentLink.findByPk(req.params.id);
 
   if (!doc) {

package/api/src/routes/payouts.ts

@@ -3,7 +3,7 @@ import { Router } from 'express';
 import Joi from 'joi';
 import pick from 'lodash/pick';
 
-import { createListParamSchema, getWhereFromKvQuery } from '../libs/api';
+import { createListParamSchema, getWhereFromKvQuery, MetadataSchema } from '../libs/api';
 import { authenticate } from '../libs/security';
 import { formatMetadata } from '../libs/util';
 import { Customer } from '../store/models/customer';
@@ -137,6 +137,10 @@ router.put('/:id', authAdmin, async (req, res) => {
 
     const raw = pick(req.body, ['metadata']);
     if (raw.metadata) {
+      const { error: metadataError } = MetadataSchema.validate(raw.metadata);
+      if (metadataError) {
+        return res.status(400).json({ error: `metadata invalid: ${metadataError.message}` });
+      }
       raw.metadata = formatMetadata(raw.metadata);
     }
 

package/api/src/routes/prices.ts

@@ -4,7 +4,7 @@ import Joi from 'joi';
 import pick from 'lodash/pick';
 import type { WhereOptions } from 'sequelize';
 
-import { createListParamSchema, getWhereFromQuery } from '../libs/api';
+import { createListParamSchema, getWhereFromQuery, MetadataSchema } from '../libs/api';
 import logger from '../libs/logger';
 import { authenticate } from '../libs/security';
 import { canUpsell } from '../libs/session';
@@ -182,6 +182,8 @@ const priceAmountSchema = Joi.object({
     )
     .optional(),
   unit_amount: Joi.number().greater(0).optional(),
+  nickname: Joi.string().max(64).empty('').optional(),
+  lookup_key: Joi.string().max(64).empty('').optional(),
 });
 
 // FIXME: @wangshijun use schema validation
@@ -195,10 +197,18 @@ router.post('/', auth, async (req, res) => {
     if (error) {
       return res.status(400).json({ error: `Price create request invalid: ${error.message}` });
     }
-    const { error: priceAmountError } = priceAmountSchema.validate(pick(req.body, ['currency_options', 'unit_amount']));
+    const { error: priceAmountError } = priceAmountSchema.validate(
+      pick(req.body, ['currency_options', 'unit_amount', 'nickname', 'lookup_key'])
+    );
     if (priceAmountError) {
       return res.status(400).json({ error: `Price create request invalid: ${priceAmountError.message}` });
     }
+    if (req.body.metadata) {
+      const { error: metadataError } = MetadataSchema.validate(req.body.metadata);
+      if (metadataError) {
+        return res.status(400).json({ error: `metadata invalid: ${metadataError.message}` });
+      }
+    }
     const result = await createPrice({
       ...req.body,
       livemode: !!req.livemode,
@@ -265,7 +275,9 @@ router.put('/:id', auth, async (req, res) => {
     return res.status(400).json({ error: `Price update request invalid: ${error.message}` });
   }
 
-  const { error: priceAmountError } = priceAmountSchema.validate(pick(req.body, ['currency_options', 'unit_amount']));
+  const { error: priceAmountError } = priceAmountSchema.validate(
+    pick(req.body, ['currency_options', 'unit_amount', 'nickname', 'lookup_key'])
+  );
   if (priceAmountError) {
     return res.status(400).json({ error: `Price update request invalid: ${priceAmountError.message}` });
   }
@@ -285,6 +297,10 @@ router.put('/:id', auth, async (req, res) => {
   }
 
   const locked = doc.locked && process.env.PAYMENT_CHANGE_LOCKED_PRICE !== '1';
+  const { error: metadataError } = MetadataSchema.validate(req.body.metadata);
+  if (metadataError) {
+    return res.status(400).json({ error: `metadata invalid: ${metadataError.message}` });
+  }
   const updates: Partial<Price> = Price.formatBeforeSave(
     pick(
       req.body,

package/api/src/routes/pricing-table.ts

@@ -8,7 +8,7 @@ import uniq from 'lodash/uniq';
 import type { WhereOptions } from 'sequelize';
 
 import { checkPassportForPricingTable } from '../integrations/blocklet/passport';
-import { createListParamSchema } from '../libs/api';
+import { createListParamSchema, MetadataSchema } from '../libs/api';
 import logger from '../libs/logger';
 import { authenticate } from '../libs/security';
 import { getBillingThreshold, getMinStakeAmount, isLineItemCurrencyAligned } from '../libs/session';
@@ -24,9 +24,46 @@ import { formatCheckoutSession } from './checkout-sessions';
 const router = Router();
 const auth = authenticate<PricingTable>({ component: true, roles: ['owner', 'admin'] });
 
-// FIXME: @wangshijun use schema validation
+const PricingTableCreateSchema = Joi.object({
+  name: Joi.string().required(),
+  description: Joi.string().allow(null, ''),
+  metadata: MetadataSchema,
+  items: Joi.array()
+    .items(
+      Joi.object({
+        price_id: Joi.string().required(),
+        product_id: Joi.string().required(),
+        after_completion: Joi.object({
+          type: Joi.string().valid('hosted_confirmation', 'redirect').required(),
+          hosted_confirmation: Joi.object({
+            custom_message: Joi.string().max(200).empty('').optional(),
+          })
+            .min(0)
+            .optional(),
+          redirect: Joi.object({
+            url: Joi.string().uri().max(2048).empty('').optional(),
+          })
+            .min(0)
+            .optional(),
+        }).unknown(true),
+        nft_mint_settings: Joi.object({
+          enabled: Joi.boolean().required(),
+          factory: Joi.string().max(40).empty('').optional(),
+        })
+          .min(0)
+          .optional(),
+      }).unknown(true)
+    )
+    .min(1)
+    .required(),
+  branding_settings: Joi.object().allow(null, {}).optional(),
+}).unknown(true);
 // eslint-disable-next-line consistent-return
 router.post('/', auth, async (req, res) => {
+  const { error } = PricingTableCreateSchema.validate(req.body);
+  if (error) {
+    return res.status(400).json({ error: `Pricing table create request invalid: ${error.message}` });
+  }
   const raw: Partial<PricingTable> = PricingTable.format(req.body);
   raw.active = true;
   raw.locked = false;
@@ -110,8 +147,48 @@ router.get('/:id', async (req, res) => {
 });
 
 // update
+// 更新schema，局部更新
+const PricingTableUpdateSchema = Joi.object({
+  name: Joi.string().optional(),
+  description: Joi.string().allow(null, '').optional(),
+  metadata: MetadataSchema.optional(),
+  items: Joi.array()
+    .items(
+      Joi.object({
+        price_id: Joi.string().required(),
+        product_id: Joi.string().required(),
+        after_completion: Joi.object({
+          type: Joi.string().valid('hosted_confirmation', 'redirect').required(),
+          hosted_confirmation: Joi.object({
+            custom_message: Joi.string().max(200).empty('').optional(),
+          })
+            .min(0)
+            .optional(),
+          redirect: Joi.object({
+            url: Joi.string().uri().max(2048).empty('').optional(),
+          })
+            .min(0)
+            .optional(),
+        }).unknown(true),
+        nft_mint_settings: Joi.object({
+          enabled: Joi.boolean().required(),
+          factory: Joi.string().max(40).empty('').optional(),
+        })
+          .min(0)
+          .optional(),
+      }).unknown(true)
+    )
+    .min(1)
+    .optional(),
+  branding_settings: Joi.object().allow(null, {}).optional(),
+}).unknown(true);
+
 // eslint-disable-next-line consistent-return
 router.put('/:id', auth, async (req, res) => {
+  const { error } = PricingTableUpdateSchema.validate(req.body);
+  if (error) {
+    return res.status(400).json({ error: `Pricing table create request invalid: ${error.message}` });
+  }
   const doc = await PricingTable.findByPk(req.params.id);
 
   if (!doc) {

package/api/src/routes/products.ts

@@ -5,7 +5,7 @@ import cloneDeep from 'lodash/cloneDeep';
 import pick from 'lodash/pick';
 import { Op } from 'sequelize';
 
-import { createListParamSchema, getWhereFromKvQuery, getWhereFromQuery } from '../libs/api';
+import { createListParamSchema, getWhereFromKvQuery, getWhereFromQuery, MetadataSchema } from '../libs/api';
 import logger from '../libs/logger';
 import { authenticate } from '../libs/security';
 import { formatMetadata } from '../libs/util';
@@ -18,7 +18,18 @@ const router = Router();
 
 const auth = authenticate<Product>({ component: true, roles: ['owner', 'admin'] });
 
-const priceAmountSchema = Joi.object({
+const ProductAndPriceSchema = Joi.object({
+  name: Joi.string().max(64).empty('').optional(),
+  type: Joi.string().valid('service', 'good').empty('').optional(),
+  description: Joi.string().max(256).empty('').optional(),
+  images: Joi.any().optional(),
+  metadata: MetadataSchema,
+  statement_descriptor: Joi.string().max(32).empty('').optional(),
+  unit_label: Joi.string().max(32).empty('').optional(),
+  nft_factory: Joi.string().max(40).allow(null).empty('').optional(),
+  features: Joi.array()
+    .items(Joi.object({ name: Joi.string().max(64).empty('').optional() }).unknown(true))
+    .optional(),
   prices: Joi.array()
     .items(
       Joi.object({
@@ -26,15 +37,16 @@ const priceAmountSchema = Joi.object({
           .items(
             Joi.object({
               unit_amount: Joi.number().greater(0).required(),
-              // 其他属性
             }).unknown(true)
           )
           .optional(),
         unit_amount: Joi.number().greater(0).required(),
+        nickname: Joi.string().max(64).empty('').optional(),
+        lookup_key: Joi.string().max(64).empty('').optional(),
       }).unknown(true)
     )
-    .required(),
-});
+    .optional(),
+}).unknown(true);
 
 export async function createProductAndPrices(payload: any) {
   const raw: Partial<Product> = pick(payload, [
@@ -128,9 +140,9 @@ export async function createProductAndPrices(payload: any) {
 // eslint-disable-next-line consistent-return
 router.post('/', auth, async (req, res) => {
   try {
-    const { error: priceAmountError } = priceAmountSchema.validate(pick(req.body, ['prices']));
-    if (priceAmountError) {
-      return res.status(400).json({ error: `Product create request invalid: ${priceAmountError.message}` });
+    const { error } = ProductAndPriceSchema.validate(req.body);
+    if (error) {
+      return res.status(400).json({ error: `Product create request invalid: ${error.message}` });
     }
     const result = await createProductAndPrices({
       ...req.body,
@@ -272,6 +284,10 @@ router.put('/:id', auth, async (req, res) => {
     'metadata',
     'cross_sell',
   ]);
+  const { error } = ProductAndPriceSchema.validate(updates);
+  if (error) {
+    return res.status(400).json({ error: `Product update request invalid: ${error.message}` });
+  }
   if (updates.metadata) {
     updates.metadata = formatMetadata(updates.metadata);
   }

package/api/src/routes/refunds.ts

@@ -5,7 +5,7 @@ import Joi from 'joi';
 import pick from 'lodash/pick';
 
 import { BN, fromTokenToUnit } from '@ocap/util';
-import { BNPositiveValidator, createListParamSchema, getWhereFromKvQuery } from '../libs/api';
+import { BNPositiveValidator, createListParamSchema, getWhereFromKvQuery, MetadataSchema } from '../libs/api';
 import { authenticate } from '../libs/security';
 import { formatMetadata } from '../libs/util';
 import {
@@ -121,8 +121,8 @@ const refundRequestSchema = Joi.object({
   reason: Joi.string()
     .valid('duplicate', 'requested_by_customer', 'requested_by_admin', 'fraudulent', 'expired_uncaptured_charge')
     .required(),
-  description: Joi.string().required(),
-  metadata: Joi.object().optional(),
+  description: Joi.string().max(200).required(),
+  metadata: MetadataSchema,
   invoice_id: Joi.string().optional(),
   subscription_id: Joi.string().optional(),
 });
@@ -149,7 +149,6 @@ router.post('/', authAdmin, async (req, res) => {
     if (!paymentMethod) {
       throw new Error(`payment method not found: ${req.body.payment_method_id}`);
     }
-
     const item = await Refund.create({
       ...req.body,
       type: 'refund',
@@ -234,6 +233,10 @@ router.put('/:id', authAdmin, async (req, res) => {
 
     const raw = pick(req.body, ['metadata']);
     if (raw.metadata) {
+      const { error: metadataError } = MetadataSchema.validate(raw.metadata);
+      if (metadataError) {
+        return res.status(400).json({ error: `metadata invalid: ${metadataError.message}` });
+      }
       raw.metadata = formatMetadata(raw.metadata);
     }
 

package/api/src/routes/subscription-items.ts

@@ -4,7 +4,7 @@ import Joi from 'joi';
 import pick from 'lodash/pick';
 import type { WhereOptions } from 'sequelize';
 
-import { createListParamSchema } from '../libs/api';
+import { createListParamSchema, MetadataSchema } from '../libs/api';
 import { authenticate } from '../libs/security';
 import { expandLineItems } from '../libs/session';
 import { formatMetadata } from '../libs/util';
@@ -32,6 +32,10 @@ router.post('/', auth, async (req, res) => {
 
   raw.livemode = req.livemode;
   if (raw.metadata) {
+    const { error: metadataError } = MetadataSchema.validate(raw.metadata);
+    if (metadataError) {
+      return res.status(400).json({ error: `metadata invalid: ${metadataError.message}` });
+    }
     raw.metadata = formatMetadata(raw.metadata);
   }
 

package/api/src/routes/subscriptions.ts

@@ -9,7 +9,7 @@ import uniq from 'lodash/uniq';
 import { literal } from 'sequelize';
 import type { Literal } from 'sequelize/types/utils';
 import { ensureStripeCustomer, ensureStripePrice, ensureStripeSubscription } from '../integrations/stripe/resource';
-import { createListParamSchema, getWhereFromKvQuery, getWhereFromQuery } from '../libs/api';
+import { createListParamSchema, getWhereFromKvQuery, getWhereFromQuery, MetadataSchema } from '../libs/api';
 import dayjs from '../libs/dayjs';
 import logger from '../libs/logger';
 import { isDelegationSufficientForPayment } from '../libs/payment';
@@ -121,7 +121,7 @@ router.get('/', authMine, async (req, res) => {
 
   if (query.activeFirst) {
     order.unshift([
-      literal("CASE status WHEN 'active' THEN 1 WHEN 'trialing' THEN 2 WHEN 'past_due' THEN 3 ELSE 4 END"),
+      literal("CASE status WHEN 'active' THEN 1 WHEN 'trialing' THEN 1 WHEN 'past_due' THEN 2 ELSE 3 END"),
       'ASC',
     ]);
   }
@@ -221,7 +221,14 @@ router.get('/:id', authPortal, async (req, res) => {
   }
 });
 
+const CommentSchema = Joi.string().max(200).empty('').optional();
+
 router.put('/:id/cancel', authPortal, async (req, res) => {
+  const { error: commentError } = CommentSchema.validate(req.body?.comment);
+  if (commentError) {
+    return res.status(400).json({ error: `comment invalid: ${commentError.message}` });
+  }
+
   const subscription = await Subscription.findByPk(req.params.id);
   logger.info('subscription cancel request', { ...req.params, ...req.body });
 
@@ -250,6 +257,7 @@ router.put('/:id/cancel', authPortal, async (req, res) => {
   if ((requestByAdmin && staking === 'proration') || req.body?.cancel_from === 'customer') {
     canReturnStake = true;
   }
+  const slashStake = requestByAdmin && staking === 'slash';
   // update cancel at
   const updates: Partial<Subscription> = {
     cancelation_details: {
@@ -257,14 +265,26 @@ router.put('/:id/cancel', authPortal, async (req, res) => {
       reason: reason || 'payment_disputed',
       feedback: feedback || 'other',
       return_stake: canReturnStake,
+      slash_stake: slashStake,
     },
   };
   const now = dayjs().unix() + 3;
-  if (req.user?.via === 'portal') {
+  if (req.user?.via === 'portal' || req.body?.cancel_from === 'customer') {
+    const inTrialing = subscription.status === 'trialing';
     updates.cancel_at_period_end = true;
     updates.cancel_at = subscription.current_period_end;
-    updates.cancelation_details = { reason: 'cancellation_requested', feedback, comment, return_stake: canReturnStake };
+    updates.cancelation_details = {
+      reason: 'cancellation_requested',
+      feedback,
+      comment,
+      return_stake: canReturnStake,
+      slash_stake: slashStake,
+    };
     updates.canceled_at = now;
+    if (inTrialing) {
+      updates.cancel_at_period_end = false;
+      updates.cancel_at = now;
+    }
     await addSubscriptionJob(subscription, 'cancel', true, updates.cancel_at);
   } else {
     if (['owner', 'admin'].includes(req.user?.role as string) === false) {
@@ -614,7 +634,7 @@ const updateSchema = Joi.object<{
   service_actions?: ServiceAction[];
 }>({
   description: Joi.string().min(1).optional(),
-  metadata: Joi.any().optional(),
+  metadata: MetadataSchema,
   payment_behavior: Joi.string().allow('allow_incomplete', 'error_if_incomplete', 'pending_if_incomplete').optional(),
   proration_behavior: Joi.string().allow('always_invoice', 'create_prorations', 'none').optional(),
   billing_cycle_anchor: Joi.string().allow('now', 'unchanged').optional(),

package/api/src/routes/webhook-endpoints.ts

@@ -3,7 +3,7 @@ import Joi from 'joi';
 import pick from 'lodash/pick';
 import type { WhereOptions } from 'sequelize';
 
-import { createListParamSchema } from '../libs/api';
+import { createListParamSchema, MetadataSchema } from '../libs/api';
 import { authenticate } from '../libs/security';
 import { formatMetadata } from '../libs/util';
 import { WebhookEndpoint } from '../store/models';
@@ -22,6 +22,10 @@ router.post('/', auth, async (req, res) => {
   raw.api_version = '2023-09-05';
   raw.status = raw.status || 'enabled';
   if (raw.metadata) {
+    const { error } = MetadataSchema.validate(raw.metadata);
+    if (error) {
+      return res.status(400).json({ error: `metadata invalid: ${error.message}` });
+    }
     raw.metadata = formatMetadata(raw.metadata);
   }
 

package/api/src/store/models/subscription.ts

@@ -62,6 +62,7 @@ export class Subscription extends Model<InferAttributes<Subscription>, InferCrea
     >;
     reason: LiteralUnion<'cancellation_requested' | 'payment_disputed' | 'payment_failed' | 'stake_revoked', string>;
     return_stake?: boolean;
+    slash_stake?: boolean;
   };
 
   declare billing_cycle_anchor: number;

package/api/tests/libs/api.spec.ts

@@ -1,6 +1,6 @@
 import { Op } from 'sequelize';
 
-import { getWhereFromQuery } from '../../src/libs/api';
+import { getWhereFromQuery, MetadataSchema } from '../../src/libs/api';
 
 describe('getWhereFromQuery', () => {
   it('should correctly parse > operator', () => {
@@ -155,3 +155,74 @@ describe('getWhereFromQuery', () => {
     expect(() => getWhereFromQuery('status === "failed"')).toThrow(/Operator not supported/);
   });
 });
+
+describe('MetadataSchema', () => {
+  it('should validate an object with string keys and custom validated values', () => {
+    const data = {
+      key1: 'value1',
+      key2: 123,
+    };
+    const { error } = MetadataSchema.validate(data);
+    expect(error).toBeUndefined();
+  });
+
+  it('should validate an array of objects with key and custom validated value', () => {
+    const data = [
+      { key: 'key1', value: 'value1' },
+      { key: 'key2', value: 123 },
+    ];
+    const { error } = MetadataSchema.validate(data);
+    expect(error).toBeUndefined();
+  });
+
+  it('should invalidate an object with a key longer than 64 characters', () => {
+    const data = {
+      ['a'.repeat(65)]: 'value1',
+    };
+    const { error } = MetadataSchema.validate(data);
+    expect(error).toBeDefined();
+    expect(error?.details?.[0]?.message).toMatch(
+      /"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" is not allowed/
+    );
+  });
+
+  it('should invalidate an array with an object missing the key field', () => {
+    const data = [{ value: 'value1' }];
+    const { error } = MetadataSchema.validate(data);
+    expect(error).toBeDefined();
+    expect(error?.details?.[0]?.message).toMatch(/"\[0\]\.key" is required/);
+  });
+
+  it('should invalidate an array with an object missing the value field', () => {
+    const data = [{ key: 'key1' }];
+    const { error } = MetadataSchema.validate(data);
+    expect(error).toBeDefined();
+    expect(error?.details?.[0]?.message).toMatch(/"\[0\]\.value" is required/);
+  });
+
+  it('should invalidate an object with a value longer than 256 characters', () => {
+    const data = {
+      key1: 'a'.repeat(257),
+    };
+    const { error } = MetadataSchema.validate(data);
+    expect(error).toBeDefined();
+    expect(error?.details?.[0]?.message).toMatch(/Metadata value should be less than 256 characters/);
+  });
+  it('should validate when data is null', () => {
+    const data = null;
+    const { error } = MetadataSchema.validate(data);
+    expect(error).toBeUndefined();
+  });
+
+  it('should validate when data is empty object', () => {
+    const data = {};
+    const { error } = MetadataSchema.validate(data);
+    expect(error).toBeUndefined();
+  });
+
+  it('should validate when data is empty array', () => {
+    const data: any[] = [];
+    const { error } = MetadataSchema.validate(data);
+    expect(error).toBeUndefined();
+  });
+});

package/api/third.d.ts

@@ -16,6 +16,8 @@ declare module 'sql-where-parser';
 
 declare module 'cls-hooked';
 
+declare module 'express-xss-sanitizer';
+
 namespace Express {
   interface Request {
     user?: {

package/blocklet.yml

@@ -14,7 +14,7 @@ repository:
   type: git
   url: git+https://github.com/blocklet/payment-kit.git
 specVersion: 1.2.8
-version: 1.14.30
+version: 1.14.31
 logo: logo.png
 files:
   - dist