Merge pull request #36219 from overleaf/jpa-zod-web-platform

[web] platform: adopt strict zod schema and extend test coverage

GitOrigin-RevId: e3a0b7b4c52ac116f28be0d284284e3bd3994cda

libraries/validation-tools/test/unit/src/zodHelpers.test.ts

@@ -842,40 +842,6 @@ describe('zodHelpers', () => {
     })
   })
 
-  describe('streamedBody', () => {
-    it('parses undefined (no body parser mounted) to undefined', () => {
-      const parsed = zz.streamedBody().safeParse(undefined)
-      expect(parsed.success).toBe(true)
-      expect(parsed.data).toBe(undefined)
-    })
-
-    it('parses the empty object left by a skipping body parser to undefined', () => {
-      const parsed = zz.streamedBody().safeParse({})
-      expect(parsed.success).toBe(true)
-      expect(parsed.data).toBe(undefined)
-    })
-
-    it('fails to parse a parsed JSON body', () => {
-      const parsed = zz.streamedBody().safeParse({ some: 'payload' })
-      expect(parsed.success).toBe(false)
-      expect(parsed.error?.issues).toMatchObject([
-        expect.objectContaining({
-          message: 'unexpected parsed request body on streamed endpoint',
-        }),
-      ])
-    })
-
-    it('fails to parse a raw buffer body', () => {
-      const parsed = zz.streamedBody().safeParse(Buffer.alloc(0))
-      expect(parsed.success).toBe(false)
-    })
-
-    it('fails to parse a string body', () => {
-      const parsed = zz.streamedBody().safeParse('text body')
-      expect(parsed.success).toBe(false)
-    })
-  })
-
   describe('uploadedFile', () => {
     const validFile = {
       fieldname: 'qqfile',

libraries/validation-tools/zodHelpers.js

@@ -206,29 +206,6 @@ const zz = {
       .min(1, { message: 'invalid event name' })
       .regex(/^[a-zA-Z0-9-_]+$/, { message: 'invalid event name' })
       .max(240, { message: 'event name is too long' }),
-  /**
-   * For endpoints that consume the request as a raw stream (e.g. blob
-   * uploads): asserts that no body parser consumed the stream before the
-   * handler. Accepts only undefined or the empty object that a skipping
-   * body parser leaves behind, and parses to undefined. If a body parser is
-   * later mounted on such a route, validation fails loudly instead of the
-   * handler silently reading an already-consumed stream.
-   */
-  streamedBody: () =>
-    z
-      .custom(
-        val => {
-          if (val === undefined) return true
-          return (
-            typeof val === 'object' &&
-            val !== null &&
-            !Buffer.isBuffer(val) &&
-            Object.keys(val).length === 0
-          )
-        },
-        { message: 'unexpected parsed request body on streamed endpoint' }
-      )
-      .transform(() => undefined),
   /**
    * A multer file object (disk storage — the only storage backend we use),
    * for validating req.file / req.files on multipart routes. The