Merge pull request #36223 from overleaf/jpa-zod-web-core-2

[web] core-2: adopt strict zod schema and extend test coverage

GitOrigin-RevId: f26d349fefb6bf9e042cb39117395120c3f7c877

services/web/app/src/Features/References/ReferencesController.mjs

@@ -1,9 +1,23 @@
 import EditorRealTimeController from '../Editor/EditorRealTimeController.mjs'
+import { z, zz, parseReq } from '../../infrastructure/Validation.mjs'
+
+const indexAllSchema = z.object({
+  params: z.strictObject({
+    Project_id: zz.objectId(),
+  }),
+  body: z.strictObject({
+    shouldBroadcast: z.boolean().optional(),
+    clientId: z.string().optional(),
+  }),
+})
 
 export default {
   indexAll(req, res, next) {
-    const projectId = req.params.Project_id
-    const { shouldBroadcast, clientId } = req.body
+    const { params, body } = parseReq(req, indexAllSchema, {
+      logOnly: true,
+    })
+    const projectId = params.Project_id
+    const { shouldBroadcast, clientId } = body
     // We've migrated to client side indexing, so we only use the message for
     // broadcasting that the clients need to re-index.
     if (shouldBroadcast) {