feat: add zod-based validation for webhook and form payloads

test/validation.test.js

@@ -0,0 +1,56 @@
+"use strict";
+
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const {
+  XWebhookPayloadSchema,
+  PolarWebhookPayloadSchema,
+  LoginFormSchema,
+  TopUpFormSchema,
+  SimulateMentionFormSchema,
+  parseOrThrow,
+} = require("../src/lib/validation");
+
+test("validates X webhook payload", () => {
+  const parsed = parseOrThrow(XWebhookPayloadSchema, {
+    mentionPostId: "m1",
+    callerUserId: "u1",
+    parentPost: { id: "p1", article: { body: "x" } },
+  });
+
+  assert.equal(parsed.mentionPostId, "m1");
+});
+
+test("validates Polar webhook payload with numeric coercion", () => {
+  const parsed = parseOrThrow(PolarWebhookPayloadSchema, {
+    userId: "u1",
+    credits: "12",
+    eventId: "evt-1",
+  });
+
+  assert.equal(parsed.credits, 12);
+});
+
+test("rejects invalid login username", () => {
+  assert.throws(
+    () => parseOrThrow(LoginFormSchema, { userId: "!" }),
+    /Username must be 2-40 characters using letters, numbers, _ or -/,
+  );
+});
+
+test("validates topup amount range", () => {
+  assert.throws(() => parseOrThrow(TopUpFormSchema, { amount: "999" }), /Too big/);
+
+  const parsed = parseOrThrow(TopUpFormSchema, { amount: "20" });
+  assert.equal(parsed.amount, 20);
+});
+
+test("validates simulate mention form", () => {
+  const parsed = parseOrThrow(SimulateMentionFormSchema, {
+    title: "Hello",
+    body: "World",
+  });
+
+  assert.equal(parsed.title, "Hello");
+  assert.equal(parsed.body, "World");
+});