ontime/apps/server/.oxlintrc.json at 972a246bb63693bfe7d134ee9b0302701ec2f6c8 - ontime - Gitea: Git with a cup of tea

cpvalente/ontime

mirror of https://github.com/cpvalente/ontime.git synced 2026-08-18 05:34:09 +00:00

Files

T

Claude 972a246bb6 feat(server): introduce Zod request validation, starting with MCP tools

Adds Zod as the validation library for apps/server (in place of
express-validator), scoped here to a low-risk slice rather than a
full migration:

- MCP tool-call arguments (apps/server/src/api-mcp) are now validated
  end to end. Every tool's inputSchema is generated from its Zod
  schema via z.toJSONSchema() instead of hand-maintained JSON Schema
  literals, and every handler now parses its arguments before use —
  previously every handler did an unchecked `args as SomeType` cast
  with no runtime validation at all.
- A new validate.ts middleware (validateBody/validateParams) replaces
  the express-validator chokepoint for two reference routers, session
  and url-presets, demonstrating the pattern the remaining ~11 routers
  will follow in later PRs.
- An oxlint no-restricted-imports guardrail keeps zod importable only
  from apps/server, so it can never leak into the apps/client bundle.

The bulk of the REST router migration (automation, rundown, and the
rest of api-data) is intentionally left for follow-up PRs to keep this
change reviewable.

2026-07-18 13:34:07 +00:00

14 lines

337 B

JSON

Raw Blame History

 {
   "$schema": "../../node_modules/oxlint/configuration_schema.json",
   "extends": ["../../.oxlintrc.json"],
   "plugins": ["unicorn", "typescript", "oxc", "vitest", "node", "promise"],
   "rules": {
     "no-restricted-imports": [
       "error",
       {
         "patterns": ["ontime-types/src/*", "ontime-utils/src/*"]
       }
     ]
   }
 }