Skip to content

REQUEST_VALIDATION.md

Latest commit

 

History

History
56 lines (41 loc) · 2.18 KB

REQUEST_VALIDATION.md

File metadata and controls

56 lines (41 loc) · 2.18 KB
Raw

Request validation (Zod)

YieldVault validates incoming HTTP data with Zod before handlers run. Invalid payloads never reach business logic.

Middleware

backend/src/middleware/validate.ts exports validate({ body, query, params }).

router.post('/admin/maintenance', validateApiKey, validate({ body: MaintenanceToggleSchema }), handler);

On failure the middleware returns 400 with:

Field Meaning
error Always Bad Request
status 400
code VALIDATION_ERROR
message Human-readable summary of all issues
summary Always Request validation failed
errors[] { code, field, message } per issue (frontend compatibility)
details[] { code, field, message } per issue
retryable false

Unknown body fields are stripped unless the schema uses .strict() (auth and webhook register/update reject unknown keys).

Schema locations

File Contents
backend/src/types/validation.ts Admin/list/body/query schemas
backend/src/types/webhooks.ts Webhook event type literals
backend/src/middleware/validate.ts Auth, alias, webhook register schemas + middleware
packages/api-schemas Shared vault deposit/withdrawal contracts

Build Order: The @yieldvault/api-schemas package must be built (npm run build:schemas or npm run build in backend) before TypeScript typechecking (tsc --noEmit) can resolve types imported by backend/src/middleware/validate.ts.

Common rules

  • Stellar addresses on login/nonce: checksummed G… public keys.
  • Pagination query: optional limit, cursor, page, sortBy, sortOrder.
  • Webhook URLs: http or https only; secrets 8–256 characters.
  • Dates: YYYY-MM-DD for APY backfill; ISO-8601 for maintenance windows.
  • IDs: path params such as :id must be non-empty strings.

Adding a new endpoint

  1. Define a Zod schema in backend/src/types/validation.ts.
  2. Attach validate({ body }) and/or validate({ query, params }) on the route.
  3. Add a case to backend/src/__tests__/validation.test.ts or requestValidation.test.ts.
  4. Document the fields in this file if they are public API.