Files
TREK/shared/src/notification/notification.schema.ts
T
jubnl 00447c9043 feat(server): validate notification request bodies
notifications.dto.ts wraps the @trek/shared request schemas via createZodDto
and types all five @Body() params; the five NotificationsController entries
leave the body-contract allow-list (ratchet gate enforced). Contract catch:
the client sends server/token: null on test-ntfy to mean 'use the saved
value', so testNtfyRequestSchema gains .nullable() there (spec pinned). The
inline response-enum and url-type checks die — malformed bodies now get the
pipe's standard envelope; valid bodies behave byte-identically. Two
integration cases pinning pre-ratchet tolerances (flat notify_* preferences
body, body-less test-smtp POST) update to the current wire contract.
2026-08-02 11:36:36 +02:00

58 lines
2.4 KiB
TypeScript

import { z } from 'zod';
/**
* Notification API contract — single source of truth for the /api/notifications
* endpoints (channel-preference matrix, channel test pings, and in-app
* notifications).
*
* The notification row and the preferences matrix are wide, DB- and
* registry-derived shapes; the response schemas keep them as open records and
* pin the stable envelope fields, while the request schemas and the bespoke
* 400/403/404 controller messages capture the parts the client depends on.
* Real-time delivery happens over the existing WebSocket path inside the
* services and is untouched by this contract.
*/
/** Channel preference matrix update: { eventType: { channel: enabled } }. */
export const preferencesUpdateRequestSchema = z.record(z.string(), z.record(z.string(), z.boolean()));
export type PreferencesUpdateRequest = z.infer<typeof preferencesUpdateRequestSchema>;
export const testSmtpRequestSchema = z.object({ email: z.string().optional() });
export const testWebhookRequestSchema = z.object({
url: z.string().optional(),
});
// server/token are nullable: the client deliberately sends null to mean
// "fall back to the saved value" (a stored token is only masked in the
// placeholder — sending null keeps the saved one).
export const testNtfyRequestSchema = z.object({
topic: z.string().optional(),
server: z.string().nullable().optional(),
token: z.string().nullable().optional(),
});
/** Result of a channel test ping. */
export const channelTestResultSchema = z.object({
success: z.boolean(),
error: z.string().optional(),
});
export type ChannelTestResult = z.infer<typeof channelTestResultSchema>;
/** Respond to a boolean (yes/no) notification. */
export const notificationRespondRequestSchema = z.object({
response: z.enum(['positive', 'negative']),
});
export type NotificationRespondRequest = z.infer<typeof notificationRespondRequestSchema>;
/** A single in-app notification row (DB-shaped; kept open). */
export const notificationRowSchema = z.record(z.string(), z.unknown());
export const inAppListResultSchema = z.object({
notifications: z.array(notificationRowSchema),
total: z.number(),
unread_count: z.number(),
});
export type InAppListResult = z.infer<typeof inAppListResultSchema>;
export const unreadCountResultSchema = z.object({ count: z.number() });
export type UnreadCountResult = z.infer<typeof unreadCountResultSchema>;