added zod for post requests

lib/api/controllers/users/postUser.ts

@@ -2,6 +2,7 @@ import { prisma } from "@/lib/api/db";
 import type { NextApiRequest, NextApiResponse } from "next";
 import bcrypt from "bcrypt";
 import isServerAdmin from "../../isServerAdmin";
+import { PostUserSchema } from "@/lib/shared/schemaValidation";
 
 const emailEnabled =
   process.env.EMAIL_FROM && process.env.EMAIL_SERVER ? true : false;
@@ -12,13 +13,6 @@ interface Data {
   status: number;
 }
 
-interface User {
-  name: string;
-  username?: string;
-  email?: string;
-  password: string;
-}
-
 export default async function postUser(
   req: NextApiRequest,
   res: NextApiResponse
@@ -29,49 +23,34 @@ export default async function postUser(
     return { response: "Registration is disabled.", status: 400 };
   }
 
-  const body: User = req.body;
+  const dataValidation = PostUserSchema().safeParse(req.body);
 
-  const checkHasEmptyFields = emailEnabled
-    ? !body.password || !body.name || !body.email
-    : !body.username || !body.password || !body.name;
+  if (!dataValidation.success) {
+    return {
+      response: `Error: ${
+        dataValidation.error.issues[0].message
+      } [${dataValidation.error.issues[0].path.join(", ")}]`,
+      status: 400,
+    };
+  }
 
-  if (!body.password || body.password.length < 8)
-    return { response: "Password must be at least 8 characters.", status: 400 };
-
-  if (checkHasEmptyFields)
-    return { response: "Please fill out all the fields.", status: 400 };
-
-  // Check email (if enabled)
-  const checkEmail =
-    /^(([^<>()[\]\.,;:\s@\"]+(\.[^<>()[\]\.,;:\s@\"]+)*)|(\".+\"))@(([^<>()[\]\.,;:\s@\"]+\.)+[^<>()[\]\.,;:\s@\"]{2,})$/i;
-  if (emailEnabled && !checkEmail.test(body.email?.toLowerCase() || ""))
-    return { response: "Please enter a valid email.", status: 400 };
-
-  // Check username (if email was disabled)
-  const checkUsername = RegExp("^[a-z0-9_-]{3,31}$");
+  const { name, email, password } = dataValidation.data;
+  let { username } = dataValidation.data;
 
   const autoGeneratedUsername = "user" + Math.round(Math.random() * 1000000000);
 
-  if (body.username && !checkUsername.test(body.username?.toLowerCase()))
-    return {
-      response:
-        "Username has to be between 3-30 characters, no spaces and special characters are allowed.",
-      status: 400,
-    };
-  else if (!body.username) {
-    body.username = autoGeneratedUsername;
+  if (!username) {
+    username = autoGeneratedUsername;
   }
 
   const checkIfUserExists = await prisma.user.findFirst({
     where: {
       OR: [
         {
-          email: body.email ? body.email.toLowerCase().trim() : undefined,
+          email: email ? email.toLowerCase().trim() : undefined,
         },
         {
-          username: body.username
-            ? body.username.toLowerCase().trim()
-            : undefined,
+          username: username ? username.toLowerCase().trim() : undefined,
         },
       ],
     },
@@ -83,7 +62,7 @@ export default async function postUser(
 
     const saltRounds = 10;
 
-    const hashedPassword = bcrypt.hashSync(body.password, saltRounds);
+    const hashedPassword = bcrypt.hashSync(password, saltRounds);
 
     // Subscription dates
     const currentPeriodStart = new Date();
@@ -93,12 +72,11 @@ export default async function postUser(
     if (isAdmin) {
       const user = await prisma.user.create({
         data: {
-          name: body.name,
+          name: name,
           username: emailEnabled
-            ? (body.username as string).toLowerCase().trim() ||
-              autoGeneratedUsername
-            : (body.username as string).toLowerCase().trim(),
-          email: emailEnabled ? body.email?.toLowerCase().trim() : undefined,
+            ? (username as string) || autoGeneratedUsername
+            : (username as string),
+          email: emailEnabled ? email : undefined,
           password: hashedPassword,
           emailVerified: new Date(),
           subscriptions: stripeEnabled
@@ -131,11 +109,9 @@ export default async function postUser(
     } else {
       await prisma.user.create({
         data: {
-          name: body.name,
-          username: emailEnabled
-            ? autoGeneratedUsername
-            : (body.username as string).toLowerCase().trim(),
-          email: emailEnabled ? body.email?.toLowerCase().trim() : undefined,
+          name: name,
+          username: emailEnabled ? autoGeneratedUsername : (username as string),
+          email: emailEnabled ? email : undefined,
           password: hashedPassword,
         },
       });