From f77fceed7edd86ed007aba9ec4d74d5c08e372ea Mon Sep 17 00:00:00 2001
From: Eric Mc Sween <5454374+emcsween@users.noreply.github.com>
Date: Thu, 3 Jul 2025 16:06:25 -0400
Subject: [PATCH] Migrate group submit form to zod

GitOrigin-RevId: c6cd882e6446730ad6a4b165871eb3148bd2fb16
---
 .../Subscription/SubscriptionGroupController.mjs     | 12 ++++++++++--
 .../src/Features/Subscription/SubscriptionRouter.mjs |  8 --------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/services/web/app/src/Features/Subscription/SubscriptionGroupController.mjs b/services/web/app/src/Features/Subscription/SubscriptionGroupController.mjs
index ddd3dba691..d9a5031014 100644
--- a/services/web/app/src/Features/Subscription/SubscriptionGroupController.mjs
+++ b/services/web/app/src/Features/Subscription/SubscriptionGroupController.mjs
@@ -1,4 +1,3 @@
-// ts-check
 import SubscriptionGroupHandler from './SubscriptionGroupHandler.js'
 
 import OError from '@overleaf/o-error'
@@ -303,10 +302,19 @@ async function createAddSeatsSubscriptionChange(req, res) {
   }
 }
 
+const submitFormSchema = z.object({
+  body: z.object({
+    adding: z.number().int().min(MAX_NUMBER_OF_USERS),
+    poNumber: z.string().optional(),
+  }),
+})
+
 async function submitForm(req, res) {
+  const { body } = validateReq(req, submitFormSchema)
+  const { adding, poNumber } = body
+
   const userId = SessionManager.getLoggedInUserId(req.session)
   const userEmail = await UserGetter.promises.getUserEmail(userId)
-  const { adding, poNumber } = req.body
 
   const { paymentProviderSubscription } =
     await SubscriptionGroupHandler.promises.getUsersGroupSubscriptionDetails(
diff --git a/services/web/app/src/Features/Subscription/SubscriptionRouter.mjs b/services/web/app/src/Features/Subscription/SubscriptionRouter.mjs
index b6ea664f07..caa4ae5984 100644
--- a/services/web/app/src/Features/Subscription/SubscriptionRouter.mjs
+++ b/services/web/app/src/Features/Subscription/SubscriptionRouter.mjs
@@ -18,8 +18,6 @@ const subscriptionRateLimiter = new RateLimiter('subscription', {
   duration: 60,
 })
 
-const MAX_NUMBER_OF_USERS = 20
-
 export default {
   apply(webRouter, privateApiRouter, publicApiRouter) {
     if (!Settings.enableSubscriptions) {
@@ -79,12 +77,6 @@ export default {
 
     webRouter.post(
       '/user/subscription/group/add-users/sales-contact-form',
-      validate({
-        body: Joi.object({
-          adding: Joi.number().integer().min(MAX_NUMBER_OF_USERS).required(),
-          poNumber: Joi.string(),
-        }),
-      }),
       RateLimiterMiddleware.rateLimit(subscriptionRateLimiter),
       SubscriptionGroupController.submitForm
     )