ts-typed-api 0.2.22 → 0.2.23

package/.kilo/plans/1779977869703-shiny-squid.md

@@ -0,0 +1,49 @@
+# Fix PATCH/DELETE Body Parsing + Add Tests
+
+## Problem
+In `src/handler.ts:400`, the Express handler only validates body for `POST` and `PUT`. `PATCH` and `DELETE` bypass Zod validation entirely, receiving raw `expressReq.body`. This is inconsistent with:
+- The Hono handler (`src/hono-cloudflare-workers.ts:377`) which validates all four methods
+- The type system (`MethodsWithBody = 'POST' | 'PUT' | 'DELETE' | 'PATCH'` in `definition.ts`)
+
+## Plan
+
+### 1. Fix `src/handler.ts` — line 400
+Change:
+```typescript
+const parsedBody = (method === 'POST' || method === 'PUT') && ('body' in routeDefinition && routeDefinition.body)
+```
+To:
+```typescript
+const parsedBody = (method === 'POST' || method === 'PUT' || method === 'DELETE' || method === 'PATCH') && ('body' in routeDefinition && routeDefinition.body)
+```
+
+### 2. Add PATCH endpoint to test setup (`tests/setup.ts`)
+Add to `SimplePublicApiDefinition` (in `examples/simple/definitions.ts`) a new `patch` route with a body schema that validates fields:
+```typescript
+patch: {
+    method: 'PATCH',
+    path: '/patch',
+    body: z.object({
+        name: z.string().min(1),
+        value: z.number().min(0)
+    }),
+    responses: CreateResponses({
+        200: z.object({ message: z.string(), name: z.string(), value: z.number() })
+    })
+}
+```
+
+Add a corresponding handler in `simplePublicHandlers` in `tests/setup.ts` that returns the parsed body data.
+
+### 3. Add tests (`tests/simple-api.test.ts`)
+Add a `describe('PATCH body validation')` block inside the existing `describe('Public API')`:
+- **Success case**: Send valid body, expect 200 with echoed data
+- **Validation failure case**: Send body with missing fields or wrong types, expect 422 with error details
+- **Extra property rejection**: Send body with an unknown property, expect 422 (strict mode)
+
+These tests will run against both Express and Hono via the existing `describe.each(['Express', SIMPLE_PORT], ['Hono', HONO_PORT])`.
+
+### 4. Verify
+Run `npm test` to confirm:
+- Existing tests still pass
+- New PATCH validation tests pass for both Express and Hono

package/dist/handler.js

@@ -339,7 +339,7 @@ middlewares, errorHandler) {
                 const parsedQuery = ('query' in routeDefinition && routeDefinition.query)
                     ? routeDefinition.query.parse(preprocessedQuery)
                     : preprocessedQuery;
-                const parsedBody = (method === 'POST' || method === 'PUT') && ('body' in routeDefinition && routeDefinition.body)
+                const parsedBody = (method === 'POST' || method === 'PUT' || method === 'PATCH' || method === 'DELETE') && ('body' in routeDefinition && routeDefinition.body)
                     ? routeDefinition.body.parse(expressReq.body)
                     : expressReq.body;
                 // Construct TypedRequest using TDef, currentDomain, currentRouteKey

package/examples/simple/definitions.ts

@@ -77,6 +77,22 @@ export const PublicApiDefinition = CreateApiDefinition({
                     200: z.string() // Raw SSE data
                 })
             },
+            patchResource: {
+                method: 'PATCH',
+                path: '/patch-resource',
+                description: 'PATCH endpoint to test body validation for PATCH requests',
+                body: z.object({
+                    name: z.string().min(1, 'Name is required'),
+                    value: z.number().int().min(0, 'Value must be non-negative')
+                }),
+                responses: CreateResponses({
+                    200: z.object({
+                        message: z.string(),
+                        name: z.string(),
+                        value: z.number()
+                    })
+                })
+            },
             disconnectTest: {
                 method: 'GET',
                 path: '/disconnect-test',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ts-typed-api",
-  "version": "0.2.22",
+  "version": "0.2.23",
   "description": "A lightweight, type-safe RPC library for TypeScript with Zod validation",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/handler.ts

@@ -397,7 +397,7 @@ export function registerRouteHandlers<TDef extends ApiDefinitionSchema>(
                     ? (routeDefinition.query as z.ZodTypeAny).parse(preprocessedQuery)
                     : preprocessedQuery;
 
-                const parsedBody = (method === 'POST' || method === 'PUT') && ('body' in routeDefinition && routeDefinition.body)
+                const parsedBody = (method === 'POST' || method === 'PUT' || method === 'PATCH' || method === 'DELETE') && ('body' in routeDefinition && routeDefinition.body)
                     ? (routeDefinition.body as z.ZodTypeAny).parse(expressReq.body)
                     : expressReq.body;
 

package/tests/setup.ts

@@ -69,7 +69,11 @@ const simplePublicHandlers = {
                 message: disconnected ? 'Client disconnected' : 'Operation completed',
                 disconnected
             });
-        }
+        },
+        patchResource: async (req: any, res: any) => {
+            const { name, value } = req.body;
+            res.respond(200, { message: 'Patched', name, value });
+        },
     },
     status: {
         probe1: async (req: any, res: any) => {

package/tests/simple-api.test.ts

@@ -328,6 +328,75 @@ describe.each([
         });
     });
 
+    describe('PATCH Body Validation', () => {
+        const client = new ApiClient(baseUrl, PublicApiDefinition);
+
+        test('should validate and parse PATCH body on success', async () => {
+            const result = await client.callApi('common', 'patchResource', {
+                body: { name: 'test-item', value: 42 }
+            }, {
+                200: ({ data }) => {
+                    expect(data.message).toBe('Patched');
+                    expect(data.name).toBe('test-item');
+                    expect(data.value).toBe(42);
+                    return data;
+                },
+                422: ({ error }) => {
+                    throw new Error(`Validation error: ${JSON.stringify(error)}`);
+                }
+            });
+
+            expect(result.message).toBe('Patched');
+            expect(result.name).toBe('test-item');
+            expect(result.value).toBe(42);
+        });
+
+        test('should reject PATCH body with missing required fields', async () => {
+            await expect(
+                client.callApi('common', 'patchResource', {
+                    body: { name: 'test' } as any
+                }, {
+                    200: ({ data }) => data,
+                    422: ({ error }) => {
+                        expect(error).toBeDefined();
+                        expect(Array.isArray(error)).toBe(true);
+                        throw new Error('Validation failed as expected');
+                    }
+                })
+            ).rejects.toThrow('Validation failed as expected');
+        });
+
+        test('should reject PATCH body with invalid field types', async () => {
+            await expect(
+                client.callApi('common', 'patchResource', {
+                    body: { name: 'test', value: 'not-a-number' } as any
+                }, {
+                    200: ({ data }) => data,
+                    422: ({ error }) => {
+                        expect(error).toBeDefined();
+                        expect(Array.isArray(error)).toBe(true);
+                        throw new Error('Validation failed as expected');
+                    }
+                })
+            ).rejects.toThrow('Validation failed as expected');
+        });
+
+        test('should reject PATCH body with extra unknown properties (strict)', async () => {
+            await expect(
+                client.callApi('common', 'patchResource', {
+                    body: { name: 'test', value: 1, extraField: 'should not be allowed' } as any
+                }, {
+                    200: ({ data }) => data,
+                    422: ({ error }) => {
+                        expect(error).toBeDefined();
+                        expect(Array.isArray(error)).toBe(true);
+                        throw new Error('Validation failed as expected');
+                    }
+                })
+            ).rejects.toThrow('Validation failed as expected');
+        });
+    });
+
     describe('Private API', () => {
         const client = new ApiClient(baseUrl, PrivateApiDefinition);