feat: server side validation implemented

Author: ADARSHsri2004

backend/package-lock.json

@@ -22,7 +22,8 @@
     "morgan": "^1.10.0",
     "nodemailer": "^7.0.9",
     "nodemon": "^3.1.10",
-    "uuid": "^13.0.0"
+    "uuid": "^13.0.0",
+    "zod": "^4.1.12"
   },
   "devDependencies": {
     "@types/bcryptjs": "^2.4.6",

backend/package.json

@@ -36,7 +36,6 @@ app.use('/api/health', healthRoutes);
 app.use("/api/products", productRoutes);
 app.use("/api/users", userRoutes);
 app.use("/api/cart", cartRoutes);
-app.use("/api/users", userRoutes);
 
 // MongoDB connect (optional)
 const mongoUri = process.env.MONGO_URI;

backend/src/app.ts

@@ -0,0 +1,24 @@
+// src/middleware/validateRequest.ts
+import { ZodObject } from "zod";
+import { Request, Response, NextFunction } from "express";
+
+const validateRequest =
+    (schema: ZodObject) =>
+        (req: Request, res: Response, next: NextFunction) => {
+            try {
+                schema.parse({
+                    body: req.body,
+                    query: req.query,
+                    params: req.params,
+                });
+                next();
+            } catch (err) {
+                return res.status(400).json({
+                    message: "Validation failed",
+                    err
+                    // errors: err.errors.map((e: any) => e.message),
+                });
+            }
+        };
+
+export default validateRequest;

backend/src/middleware/auth.middleware.ts

@@ -6,15 +6,23 @@ import {
   getCart,
   checkout,
 } from "../controllers/cart.controller";
-import { authenticate } from "../middleware/authMiddleware";
+import { protect } from "../middleware/authMiddleware";
+import validateRequest from "../middleware/validateRequest";
+import {
+  addItemSchema,
+  removeItemSchema,
+  updateQuantitySchema,
+  getCartSchema,
+  checkoutSchema,
+} from "../validations/cartValidation";
 
 const router: Router = express.Router();
 
 //Protected routes
-router.post("/", authenticate, addItem);
-router.patch("/:itemId", authenticate, updateQuantity);
-router.delete("/:itemId", authenticate, removeItem);
-router.get("/", authenticate, getCart);
-router.post("/checkout", authenticate, checkout);
+router.post("/add", protect, validateRequest(addItemSchema), addItem);
+router.patch("/:itemId", protect, validateRequest(updateQuantitySchema), updateQuantity);
+router.delete("/:itemId", protect, removeItem);
+router.get("/", protect, getCart);
+router.post("/checkout", protect, validateRequest(checkoutSchema), checkout);
 
 export default router;

backend/src/middleware/validateRequest.ts

@@ -7,16 +7,22 @@ import {
     deleteProduct,
 } from "../controllers/product.controller";
 
+import {
+    createProductSchema,
+    updateProductSchema,
+    getProductByIdSchema,
+    deleteProductSchema,
+    getProductsSchema,
+} from "../validations/product.validation";
+import validateRequest from "../middleware/validateRequest";
 const router = Router();
 
-// router.post("/", verifyAuth, createProduct);
-router.post("/", createProduct);
-router.get("/", getProducts);
-router.get("/:id", getProductById);
-// router.put("/:id", verifyAuth, updateProduct);
-router.put("/:id", updateProduct);
-// router.delete("/:id", verifyAuth, deleteProduct);
-router.delete("/:id", deleteProduct);
+
+router.post("/", validateRequest(createProductSchema), createProduct);
+router.get("/", validateRequest(getProductsSchema), getProducts);
+router.get("/:id", validateRequest(getProductByIdSchema), getProductById);
+router.put("/:id", validateRequest(updateProductSchema), updateProduct);
+router.delete("/:id", validateRequest(deleteProductSchema), deleteProduct);
 
 export default router;
 

backend/src/routes/cartRoutes.ts

@@ -2,12 +2,17 @@
 import express from "express";
 import { register, verifyEmail, login, getMe } from "../controllers/auth.controller";
 import { protect } from "../middleware/authMiddleware";
-
+import validateRequest from "../middleware/validateRequest";
+import {
+    registerSchema,
+    loginSchema,
+    verifyEmailSchema,
+} from "../validations/userValidation";
 const router = express.Router();
 
-router.post("/register", register);
-router.get("/verify/:token", verifyEmail);
-router.post("/login", login);
+router.post("/register", validateRequest(registerSchema), register);
+router.get("/verify/:token", validateRequest(verifyEmailSchema), verifyEmail);
+router.post("/login", validateRequest(loginSchema), login);
 router.get("/me", protect, getMe);
 
 export default router;

backend/src/routes/product.routes.ts

@@ -0,0 +1,29 @@
+import { z } from "zod";
+
+export const addItemSchema = z.object({
+    body: z.object({
+        productId: z.string().min(1, "Product ID is required"),
+        name: z.string().min(2, "Product name is required"),
+        price: z.number().positive("Price must be positive"),
+        quantity: z.number().int().positive("Quantity must be a positive integer"),
+    }),
+});
+
+export const removeItemSchema = z.object({
+    params: z.object({
+        itemId: z.string().min(1, "Item ID is required"),
+    }),
+});
+
+export const updateQuantitySchema = z.object({
+    params: z.object({
+        itemId: z.string().min(1, "Item ID is required"),
+    }),
+    body: z.object({
+        quantity: z.number().int().positive("Quantity must be a positive integer"),
+    }),
+});
+
+export const getCartSchema = z.object({});
+
+export const checkoutSchema = z.object({});

backend/src/routes/user.routes.ts

@@ -0,0 +1,47 @@
+// src/validations/product.validation.ts
+import { z } from "zod";
+
+export const createProductSchema = z.object({
+    body: z.object({
+        name: z.string().min(1, "Name is required"),
+        description: z.string().min(1, "Description is required"),
+        price: z.number().positive(),
+        category: z.string().optional(),
+        stock: z.number().optional(),
+    }),
+});
+
+export const updateProductSchema = z.object({
+    params: z.object({
+        id: z.string(),
+    }),
+    body: z.object({
+        name: z.string().optional(),
+        description: z.string().optional(),
+        price: z.number().optional(),
+        category: z.string().optional(),
+        stock: z.number().optional(),
+    }),
+});
+
+export const getProductByIdSchema = z.object({
+    params: z.object({
+        id: z.string(),
+    }),
+});
+
+export const deleteProductSchema = z.object({
+    params: z.object({
+        id: z.string(),
+    }),
+});
+
+export const getProductsSchema = z.object({
+    query: z.object({
+        search: z.string().optional(),
+        category: z.string().optional(),
+        minPrice: z.string().optional(),
+        maxPrice: z.string().optional(),
+        sort: z.enum(["asc", "desc", "lowToHigh", "highToLow"]).optional(),
+    }),
+});