Validate at the Boundary

import { z } from 'zod';

export function validate({ body, query, params }) {
  return (req, res, next) => {
    const results = {};

    for (const [key, schema] of Object.entries({ body, query, params })) {
      if (!schema) continue;
      const parsed = schema.safeParse(req[key]);
      if (!parsed.success) {
        return res.status(400).json({
          error: 'validation_failed',
          location: key,
          issues: parsed.error.issues.map((i) => ({
            path: i.path.join('.') || '(root)',
            code: i.code,
            message: i.message,
          })),
        });
      }
      results[key] = parsed.data;
    }

    // CRITICAL: replace with the PARSED values. Coercion, defaults and the
    // removal of unknown keys only take effect if downstream code reads these.
    Object.assign(req, results);
    next();
  };
}

// Query strings are all strings — coerce explicitly and bound the result.
const listQuery = z.object({
  limit: z.coerce.number().int().min(1).max(100).default(20),
  cursor: z.string().max(200).optional(),
  status: z.enum(['open', 'paid', 'void']).optional(),
  sort: z.enum(['createdAt', 'total']).default('createdAt'),   // never raw SQL
  order: z.enum(['asc', 'desc']).default('desc'),
}).strict();

app.get('/api/invoices', auth, validate({ query: listQuery }), async (req, res) => {
  // req.query.limit is a NUMBER, bounded to 100, with a default applied.
  // req.query.sort is one of two literals, so it is safe to interpolate.
  const rows = await db('invoices')
    .where({ user_id: req.user.id })
    .modify((q) => req.query.status && q.where({ status: req.query.status }))
    .orderBy(req.query.sort, req.query.order)
    .limit(req.query.limit);

  res.json({ data: rows.map(InvoiceSerializer.public) });
});

// The enum on `sort` is doing security work: it is the only safe way to let a
// client influence an ORDER BY clause, which cannot be parameterised.

// A schema cannot protect you from a payload that kills the parser first.

// 1. Body size — the outermost limit
app.use(express.json({
  limit: '100kb',                       // most APIs need far less than 1mb
  strict: true,                         // only objects and arrays at the root
  verify: (req, res, buf) => { req.rawBody = buf; },   // for webhook signatures
}));

// Per-route override where a larger body is genuinely needed
app.post('/api/documents', express.json({ limit: '5mb' }), createDocument);

// 2. JSON depth — {"a":{"a":{"a": ... }}} 50,000 deep exhausts the stack
function depthLimit(max = 20) {
  return (req, res, next) => {
    const depth = (v, d = 0) => {
      if (d > max || v === null || typeof v !== 'object') return d;
      return Math.max(d, ...Object.values(v).map((c) => depth(c, d + 1)));
    };
    if (depth(req.body) > max) {
      return res.status(400).json({ error: 'payload_too_deep' });
    }
    next();
  };
}

// 3. Key count — {"a1":1,"a2":1, ... } with a million keys
function keyLimit(max = 200) {
  return (req, res, next) =>
    Object.keys(req.body ?? {}).length > max
      ? res.status(400).json({ error: 'too_many_fields' })
      : next();
}

app.use(depthLimit(20), keyLimit(200));

// 4. Prototype pollution — reject the poisoning keys during parse
app.use(express.json({
  reviver: (key, value) =>
    ['__proto__', 'constructor', 'prototype'].includes(key) ? undefined : value,
}));

// 5. Content-Type — refuse what you do not handle
app.use((req, res, next) => {
  if (!['POST', 'PUT', 'PATCH'].includes(req.method)) return next();
  const ct = (req.get('content-type') ?? '').split(';')[0].trim();
  if (!['application/json', 'multipart/form-data'].includes(ct)) {
    return res.status(415).json({ error: 'unsupported_media_type' });
  }
  next();
});

// Ordering matters: size → content-type → parse → depth → schema.
// Each layer protects the one after it.

<?php
// Laravel — the rules ARE the allowlist, and validated() returns ONLY them.
public function store(Request $request)
{
    $data = $request->validate([
        'items'              => ['required', 'array', 'min:1', 'max:50'],
        'items.*.productId'  => ['required', 'uuid'],
        'items.*.quantity'   => ['required', 'integer', 'min:1', 'max:100'],
        'note'               => ['nullable', 'string', 'max:500'],
        'couponCode'         => ['nullable', 'string', 'regex:/^[A-Z0-9]{4,16}$/'],
    ]);

    // ✅ $data contains ONLY the validated keys — this is the allowlist.
    // ❌ $request->all() would include everything the attacker sent.
    $order = Order::create([
        ...$data,
        'user_id' => $request->user()->id,      // from the credential, not input
        'total'   => $this->calculateTotal($data['items']),   // server-computed
    ]);

    return new OrderResource($order);           // explicit output shape
}

// Reject unknown keys explicitly — Laravel ignores them by default.
public function rules(): array { /* ... */ }
public function withValidator($validator): void
{
    $validator->after(function ($v) {
        $unknown = array_diff(array_keys($this->all()), array_keys($this->rules()));
        if ($unknown) {
            $v->errors()->add('body', 'Unexpected fields: ' . implode(', ', $unknown));
        }
    });
}

# ------------------------------------------------------------------
# Python — Pydantic v2
# from pydantic import BaseModel, Field, ConfigDict
#
# class OrderItem(BaseModel):
#     model_config = ConfigDict(extra='forbid')     # ← reject unknown keys
#     product_id: UUID
#     quantity: int = Field(ge=1, le=100)
#
# class CreateOrder(BaseModel):
#     model_config = ConfigDict(extra='forbid')
#     items: list[OrderItem] = Field(min_length=1, max_length=50)
#     note: str | None = Field(default=None, max_length=500)
#
# @app.post('/api/orders')
# async def create(order: CreateOrder, user = Depends(current_user)):
#     ...   # FastAPI validates before the handler body runs at all