From 88857237a2bfa30aa496936b606ad82901cd7f7a Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> Date: Thu, 11 Jun 2026 05:06:58 -0300 Subject: [PATCH] fix(guardrails): use validateBody() in /api/guardrails/test route (#3621) Replaces request.json() + TestRequestSchema.parse() pattern with the canonical validateBody()/isValidationFailure() pattern from @/shared/validation/helpers, satisfying check:route-validation:t06. --- src/app/api/guardrails/test/route.ts | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/src/app/api/guardrails/test/route.ts b/src/app/api/guardrails/test/route.ts index 29f2c4872b..20412d4e41 100644 --- a/src/app/api/guardrails/test/route.ts +++ b/src/app/api/guardrails/test/route.ts @@ -14,6 +14,7 @@ import { CORS_HEADERS, handleCorsOptions } from "@/shared/utils/cors"; import { createErrorResponse } from "@/lib/api/errorResponse"; import { requireManagementAuth } from "@/lib/api/requireManagementAuth"; import { registerDefaultGuardrails } from "@/lib/guardrails/registry"; +import { validateBody, isValidationFailure } from "@/shared/validation/helpers"; const TestRequestSchema = z.object({ input: z.union([z.string(), z.record(z.unknown()), z.array(z.unknown())]), @@ -28,17 +29,19 @@ export async function POST(request: NextRequest) { const authError = await requireManagementAuth(request); if (authError) return authError; - let parsed: z.infer; + let rawBody: unknown; try { - parsed = TestRequestSchema.parse(await request.json()); + rawBody = await request.json(); } catch { - return createErrorResponse({ - status: 400, - message: "Invalid request body — expected { input: string | object | array, disabledGuardrails?: string[] }", - type: "invalid_request", - }); + return createErrorResponse({ status: 400, message: "Invalid JSON body", type: "invalid_request" }); } + const validation = validateBody(TestRequestSchema, rawBody); + if (isValidationFailure(validation)) { + return createErrorResponse({ status: 400, message: "Invalid request body — expected { input: string | object | array, disabledGuardrails?: string[] }", type: "invalid_request" }); + } + const parsed = validation.data; + const registry = registerDefaultGuardrails(); const outcome = await registry.runPreCallHooks(parsed.input, { disabledGuardrails: parsed.disabledGuardrails,