Matt
acf878f997
Resolved 65 type errors across the codebase via these v4 migration
patterns:
- `ZodError.errors` renamed to `ZodError.issues` (4 call sites in auth
routes + central error handler).
- `z.record(value)` now requires explicit key type: `z.record(z.string(),
value)`. Updated 7 sites across templates / forms / saved-views /
website-inquiries.
- `.refine(check, msgFn)` second-arg shape changed — now requires an
`{ error: (issue) => ... }` object form. Updated
`mergeFieldsSchema` in document-templates validator.
- `.transform(...).default(...)` chains: v4 enforces default value type
matches transform OUTPUT. Reordered to `.default(...).transform(...)`
in list-query / company-memberships handlers.
- `z.coerce.*()` INPUT type widened to `unknown` in v4. Service signatures
using `z.input<typeof schema>` (kept for caller flexibility around
defaults) now re-parse via `schema.parse(data)` to recover the
post-coercion shape Drizzle needs. Done in berth-reservations service.
Invoice service narrows `lineItems` locally with a typed cast since
re-parsing would double-validate.
- `.optional().transform(...)` no longer propagates the optional marker
through v4's new ZodPipe. Moved `.optional()` to the END of chain in
`optionalDesiredDimSchema` (interests) and documents list query
(folderId, signatureOnly).
- ZodIssue subtype shapes simplified: `received` removed from
invalid_type, `type` renamed to `origin` on too_small. Test fixtures
updated.
- @hookform/resolvers v5 splits Resolver into 3-generic form (Input,
Context, Output). useForm calls in 6 forms (client, yacht, berth,
interest, expense, invoices-new-page) now pass explicit generics:
`useForm<z.input<typeof schema>, unknown, z.infer<typeof schema>>`.
Verified: tsc clean (0 errors), vitest 1293/1293 pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
37 lines
1.1 KiB
TypeScript
37 lines
1.1 KiB
TypeScript
import { NextRequest, NextResponse } from 'next/server';
|
|
import { z } from 'zod';
|
|
|
|
import { enforcePublicRateLimit } from '@/lib/api/route-helpers';
|
|
import { errorResponse, ValidationError } from '@/lib/errors';
|
|
import { resetPassword } from '@/lib/services/portal-auth.service';
|
|
|
|
const bodySchema = z.object({
|
|
token: z.string().min(1),
|
|
password: z.string().min(9),
|
|
});
|
|
|
|
export async function POST(req: NextRequest): Promise<NextResponse> {
|
|
// 10/hour/IP — bounds brute-force against the 32-byte reset token.
|
|
const limited = await enforcePublicRateLimit(req, 'portalToken');
|
|
if (limited) return limited;
|
|
|
|
try {
|
|
let body: unknown;
|
|
try {
|
|
body = await req.json();
|
|
} catch {
|
|
throw new ValidationError('Invalid request body');
|
|
}
|
|
|
|
const parsed = bodySchema.safeParse(body);
|
|
if (!parsed.success) {
|
|
throw new ValidationError(parsed.error.issues[0]?.message ?? 'Invalid input');
|
|
}
|
|
|
|
await resetPassword(parsed.data.token, parsed.data.password);
|
|
return NextResponse.json({ success: true });
|
|
} catch (err) {
|
|
return errorResponse(err);
|
|
}
|
|
}
|