feat: add runtime validation

package.json

@@ -30,6 +30,7 @@
     "test": "pnpm lint && vitest run --coverage"
   },
   "dependencies": {
+    "@decs/typeschema": "^0.5.2",
     "cookie-es": "^1.0.0",
     "defu": "^6.1.2",
     "destr": "^2.0.0",
@@ -58,7 +59,8 @@
     "supertest": "^6.3.3",
     "typescript": "^5.1.6",
     "unbuild": "^1.2.1",
-    "vitest": "^0.33.0"
+    "vitest": "^0.33.0",
+    "zod": "^3.21.4"
   },
   "packageManager": "[email protected]"
 }

src/utils/body.ts

@@ -1,9 +1,10 @@
 import type { IncomingMessage } from "node:http";
-import destr from "destr";
+import destr, { safeDestr } from "destr";
 import type { Encoding, HTTPMethod } from "../types";
 import type { H3Event } from "../event";
 import { createError } from "../error";
 import { parse as parseMultipartData } from "./internal/multipart";
+import { assertSchema, type Infer, type Schema } from "./internal/validation";
 import { assertMethod, getRequestHeader } from "./request";
 
 export type { MultiPartData } from "./internal/multipart";
@@ -183,3 +184,32 @@ function _parseURLEncodedBody(body: string) {
   }
   return parsedForm as unknown;
 }
+
+/**
+ * Accept an event and a schema, and return a typed and runtime validated object.
+ * Throws an error if the object doesn't match the schema.
+ * @param event {H3Event}
+ * @param schema {Schema} Any valid schema: zod, yup, joi, ajv, superstruct, io-ts, ow, typebox, typia, deepkit,
+ *  runtypes, arktype or custom validation function.
+ * @param onError {Function} Optional error handler. Will receive the error thrown by the schema validation as first argument.
+ */
+export async function readBodySafe<TSchema extends Schema>(
+  event: H3Event,
+  schema: TSchema,
+  onError?: (err: any) => any
+) {
+  if (ParsedBodySymbol in event.node.req) {
+    return (event.node.req as any)[ParsedBodySymbol] as Infer<typeof schema>;
+  }
+  const contentType = getRequestHeader(event, "content-type");
+  if (contentType?.startsWith("application/x-www-form-urlencoded")) {
+    const formPayload = Object.fromEntries(await readFormData(event));
+    const result = await assertSchema(schema, formPayload, onError);
+    (event.node.req as any)[ParsedBodySymbol] = result;
+    return result as Infer<typeof schema>;
+  }
+  const json = safeDestr(await readRawBody(event));
+  const result = await assertSchema(schema, json, onError);
+  (event.node.req as any)[ParsedBodySymbol] = result;
+  return result as Infer<typeof schema>;
+}

src/utils/internal/validation.ts

@@ -0,0 +1,19 @@
+import type { Schema } from "@decs/typeschema";
+import { assert } from "@decs/typeschema";
+import { createError } from "src/error";
+export type { Infer, Schema } from "@decs/typeschema";
+
+export const assertSchema = async <T>(
+  schema: Schema,
+  payload: T,
+  onError?: (err: any) => any
+) => {
+  try {
+    return await assert(schema, payload);
+  } catch (error) {
+    if (onError) {
+      return onError(error);
+    }
+    throw createError({ statusCode: 500, statusMessage: "Assertion Error." });
+  }
+};

src/utils/request.ts

@@ -2,6 +2,7 @@ import { getQuery as _getQuery } from "ufo";
 import { createError } from "../error";
 import type { HTTPMethod, RequestHeaders } from "../types";
 import type { H3Event } from "../event";
+import { assertSchema, type Infer, type Schema } from "./internal/validation";
 
 export function getQuery(event: H3Event) {
   return _getQuery(event.path || "");
@@ -127,3 +128,21 @@ export function getRequestURL(
   const path = event.path;
   return new URL(path, `${protocol}://${host}`);
 }
+
+/**
+ * Accept an event and a schema, and return a typed and runtime validated object.
+ * Throws an error if the object doesn't match the schema.
+ * @param event {H3Event}
+ * @param schema {Schema} Any valid schema: zod, yup, joi, ajv, superstruct, io-ts, ow, typebox, typia, deepkit,
+ *  runtypes, arktype or custom validation function.
+ * @param onError {Function} Optional error handler. Will receive the error thrown by the schema validation as first argument.
+ */
+export async function getQuerySafe<TSchema extends Schema>(
+  event: H3Event,
+  schema: TSchema,
+  onError?: (err: any) => any
+) {
+  const query = getQuery(event);
+  const result = await assertSchema(schema, query, onError);
+  return result as Infer<typeof schema>;
+}