fix(rest/nodejs): enforce integer and minimum bounds on line item quantity

rest/nodejs/src/models/index.ts

@@ -12,4 +12,47 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+import * as sdk from "@ucp-js/sdk";
+import { z } from "zod";
+
 export * from "@ucp-js/sdk";
+
+export const LineItemCreateRequestSchema =
+  sdk.LineItemCreateRequestSchema.extend({
+    quantity: z.number().int().gte(1),
+  });
+export type LineItemCreateRequest = z.infer<typeof LineItemCreateRequestSchema>;
+
+export const LineItemUpdateRequestSchema =
+  sdk.LineItemUpdateRequestSchema.extend({
+    quantity: z.number().int().gte(1),
+  });
+export type LineItemUpdateRequest = z.infer<typeof LineItemUpdateRequestSchema>;
+
+export const CheckoutCreateRequestSchema =
+  sdk.CheckoutCreateRequestSchema.extend({
+    line_items: z.array(LineItemCreateRequestSchema),
+  });
+export type CheckoutCreateRequest = z.infer<typeof CheckoutCreateRequestSchema>;
+
+export const CheckoutUpdateRequestSchema =
+  sdk.CheckoutUpdateRequestSchema.extend({
+    line_items: z.array(LineItemUpdateRequestSchema),
+  });
+export type CheckoutUpdateRequest = z.infer<typeof CheckoutUpdateRequestSchema>;
+
+export const ExtendedCheckoutCreateRequestSchema =
+  sdk.ExtendedCheckoutCreateRequestSchema.extend({
+    line_items: z.array(LineItemCreateRequestSchema),
+  });
+export type ExtendedCheckoutCreateRequest = z.infer<
+  typeof ExtendedCheckoutCreateRequestSchema
+>;
+
+export const ExtendedCheckoutUpdateRequestSchema =
+  sdk.ExtendedCheckoutUpdateRequestSchema.extend({
+    line_items: z.array(LineItemUpdateRequestSchema),
+  });
+export type ExtendedCheckoutUpdateRequest = z.infer<
+  typeof ExtendedCheckoutUpdateRequestSchema
+>;

rest/nodejs/test/validation_flow.test.ts

@@ -20,8 +20,11 @@ import { Hono } from "hono";
 
 import { CheckoutService } from "../src/api/checkout";
 import { getProductsDb, getTransactionsDb, initDbs } from "../src/data/db";
-import { ExtendedCheckoutCreateRequestSchema } from "../src/models";
-import { prettyValidation } from "../src/utils/validation";
+import {
+  ExtendedCheckoutCreateRequestSchema,
+  ExtendedCheckoutUpdateRequestSchema,
+} from "../src/models";
+import { IdParamSchema, prettyValidation } from "../src/utils/validation";
 
 function buildApp() {
   const svc = new CheckoutService();
@@ -35,6 +38,12 @@ function buildApp() {
     zValidator("json", ExtendedCheckoutCreateRequestSchema, prettyValidation),
     svc.createCheckout
   );
+  app.put(
+    "/checkout-sessions/:id",
+    zValidator("param", IdParamSchema, prettyValidation),
+    zValidator("json", ExtendedCheckoutUpdateRequestSchema, prettyValidation),
+    svc.updateCheckout
+  );
   return app;
 }
 
@@ -63,6 +72,23 @@ async function create(app: ReturnType<typeof buildApp>, lineItems: unknown) {
   });
 }
 
+async function update(
+  app: ReturnType<typeof buildApp>,
+  id: string,
+  lineItems: unknown
+) {
+  return app.request(`/checkout-sessions/${id}`, {
+    method: "PUT",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      id,
+      currency: "USD",
+      line_items: lineItems,
+      payment: {},
+    }),
+  });
+}
+
 test("an unknown product id is rejected", async () => {
   const app = buildApp();
   const res = await create(app, [
@@ -96,3 +122,87 @@ test("ordering within the available stock succeeds", async () => {
   ]);
   assert.equal(res.status, 201);
 });
+
+test("checkout create rejects quantity 0 with 422", async () => {
+  const app = buildApp();
+  const res = await create(app, [
+    { item: { id: "bouquet_roses" }, quantity: 0 },
+  ]);
+  assert.equal(res.status, 422);
+  const text = await res.text();
+  assert.match(text, /line_items\[0\]\.quantity/);
+  assert.match(text, /greater than or equal to 1/i);
+});
+
+test("checkout create rejects negative quantity with 422", async () => {
+  const app = buildApp();
+  const res = await create(app, [
+    { item: { id: "bouquet_roses" }, quantity: -1 },
+  ]);
+  assert.equal(res.status, 422);
+  const text = await res.text();
+  assert.match(text, /line_items\[0\]\.quantity/);
+  assert.match(text, /greater than or equal to 1/i);
+});
+
+test("checkout create rejects non-integer quantity with 422", async () => {
+  const app = buildApp();
+  const res = await create(app, [
+    { item: { id: "bouquet_roses" }, quantity: 1.5 },
+  ]);
+  assert.equal(res.status, 422);
+  const text = await res.text();
+  assert.match(text, /line_items\[0\]\.quantity/);
+  assert.match(text, /Expected integer/i);
+});
+
+test("checkout update rejects quantity 0 with 422", async () => {
+  const app = buildApp();
+  const createRes = await create(app, [
+    { item: { id: "bouquet_roses" }, quantity: 1 },
+  ]);
+  assert.equal(createRes.status, 201);
+  const checkout = (await createRes.json()) as { id: string };
+
+  const updateRes = await update(app, checkout.id, [
+    { item: { id: "bouquet_roses" }, quantity: 0 },
+  ]);
+  assert.equal(updateRes.status, 422);
+  const text = await updateRes.text();
+  assert.match(text, /line_items\[0\]\.quantity/);
+  assert.match(text, /greater than or equal to 1/i);
+});
+
+test("checkout update rejects negative quantity with 422", async () => {
+  const app = buildApp();
+  const createRes = await create(app, [
+    { item: { id: "bouquet_roses" }, quantity: 1 },
+  ]);
+  assert.equal(createRes.status, 201);
+  const checkout = (await createRes.json()) as { id: string };
+
+  const updateRes = await update(app, checkout.id, [
+    { item: { id: "bouquet_roses" }, quantity: -1 },
+  ]);
+  assert.equal(updateRes.status, 422);
+  const text = await updateRes.text();
+  assert.match(text, /line_items\[0\]\.quantity/);
+  assert.match(text, /greater than or equal to 1/i);
+});
+
+test("checkout update rejects non-integer quantity with 422", async () => {
+  const app = buildApp();
+  const createRes = await create(app, [
+    { item: { id: "bouquet_roses" }, quantity: 1 },
+  ]);
+  assert.equal(createRes.status, 201);
+  const checkout = (await createRes.json()) as { id: string };
+
+  const updateRes = await update(app, checkout.id, [
+    { item: { id: "bouquet_roses" }, quantity: 2.5 },
+  ]);
+  assert.equal(updateRes.status, 422);
+  const text = await updateRes.text();
+  assert.match(text, /line_items\[0\]\.quantity/);
+  assert.match(text, /Expected integer/i);
+});