Files
crm-server/src/middlewares/security/validateInput.js

130 lines
3.3 KiB
JavaScript

import { ZodError } from 'zod';
import { ValidationError } from '../../utils/errors.js';
import { logger } from '../../utils/logger.js';
/**
* Middleware na validáciu request body pomocou Zod schema
* @param {ZodSchema} schema - Zod validačná schéma
*/
export const validateBody = (schema) => {
return async (req, res, next) => {
try {
// Validuj request body
const validated = await schema.parseAsync(req.body);
// Nahraď body validovanými dátami
req.body = validated;
next();
} catch (error) {
if (error instanceof ZodError && error.errors) {
// Zformátuj Zod chyby
const formattedErrors = error.errors.map((err) => ({
field: err.path.join('.'),
message: err.message,
}));
return res.status(400).json({
success: false,
error: {
message: 'Validačná chyba',
statusCode: 400,
details: formattedErrors,
},
});
}
// Log unexpected errors
logger.error('Validation error', { error: error.message });
return res.status(400).json({
success: false,
error: {
message: error?.message || 'Neplatné vstupné dáta',
statusCode: 400,
},
});
}
};
};
/**
* Middleware na validáciu query parametrov
* @param {ZodSchema} schema - Zod validačná schéma
*/
export const validateQuery = (schema) => {
return async (req, res, next) => {
try {
const validated = await schema.parseAsync(req.query);
req.query = validated;
next();
} catch (error) {
if (error instanceof ZodError && error.errors) {
const formattedErrors = error.errors.map((err) => ({
field: err.path.join('.'),
message: err.message,
}));
return res.status(400).json({
success: false,
error: {
message: 'Validačná chyba v query parametroch',
statusCode: 400,
details: formattedErrors,
},
});
}
logger.error('Query validation error', { error: error.message });
return res.status(400).json({
success: false,
error: {
message: error?.message || 'Neplatné query parametre',
statusCode: 400,
},
});
}
};
};
/**
* Middleware na validáciu URL parametrov
* @param {ZodSchema} schema - Zod validačná schéma
*/
export const validateParams = (schema) => {
return async (req, res, next) => {
try {
const validated = await schema.parseAsync(req.params);
req.params = validated;
next();
} catch (error) {
if (error instanceof ZodError && error.errors) {
const formattedErrors = error.errors.map((err) => ({
field: err.path.join('.'),
message: err.message,
}));
return res.status(400).json({
success: false,
error: {
message: 'Validačná chyba v URL parametroch',
statusCode: 400,
details: formattedErrors,
},
});
}
logger.error('Params validation error', { error: error.message });
return res.status(400).json({
success: false,
error: {
message: error?.message || 'Neplatné URL parametre',
statusCode: 400,
},
});
}
};
};