cloudflare / cloudflare/chanfana
Bug: chanfana assumes all instances of `ZodError` thrown from a route's `handle` method are 400 user request validation errors
- Dominant language
- TypeScript
- Stars
- 766
- Forks
- 70
- Avg merge
- 25m
- Merged PRs (30d)
- 4
Description
**Bug description**: If a route's `handle` method throws a `ZodError` that's not coming from `validateRequest`, chanfana erroneously returns 400 to the user, also exposing the route's internal implementation details in the response body.
**Desired behavior**: only errors thrown from `getValidatedData` are assumed to be a user request validation error.
**Example**:
```ts
import { fromIttyRouter, OpenAPIRoute } from 'chanfana';
import { json, Router } from 'itty-router';
import { z } from 'zod';
const schema = z.object({ hello: z.string().default('world') });
export class MyRoute extends OpenAPIRoute {
schema = {
request: {
body: {
content: {
'application/json': {
schema,
},
},
},
},
responses: {
'201': {
description: 'Return request body after validation',
content: {
'application/json': {
schema,
},
},
},
},
};
async handle() {
const data = await this.getValidatedData();
// Internal logic executed after successful user request validation
const internalSchema = z.object({ internal: z.string().max(3) });
internalSchema.parse({ internal: 'Highly senstive data' });
return json(data.body);
}
}
export default fromIttyRouter(Router()).post('/hello', MyRoute);
```
for all valid requests will always return `400 Bad Request`
```
{
"errors": [
{
"code": "invalid_type",
"expected": "string",
"message": "Required",
"path": [
"internal",
],
"received": "undefined",
},
],
"result": {},
"success": false,
}
```
Contributor guide
Research direction
Start by tracing OpenAPIRoute.getValidatedData from the route handle method through the error handling used by fromIttyRouter. Verify that only errors from request validation produce a 400 response, while a ZodError raised by internal route logic does not expose its implementation details; add or run the relevant error-handling tests if present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100