mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
9650ad4597
New tripInviteLinkCreateRequestSchema in @trek/shared (single source of truth), a createZodDto wrapper on the controller's raw @Body(), and the TripInviteLinkController.create entry dropped from the body-contract allow-list (the boot ratchet enforces it). expires_in_days accepts number | digits-only string | null | absent — the string branch is digits-only so garbage like "7abc" is a 400 instead of silently parseInt-ing to 7; the empty string (blank form input, meaning no expiry) stays accepted. The e2e registers ZodValidationPipe and pins both the bounded-expiry and 400 paths.