Add response schema stability test for /api/export [b#074]

src/routes/exports.ts

@@ -2,40 +2,20 @@ import { Router } from 'express';
 import { z } from 'zod';
 import { requireAuth } from '../middleware/requireAuth.js';
 import { ValidationError } from '../middleware/validate.js';
-import { requireAuth } from '../middleware/requireAuth.js';
-import { validate } from '../middleware/validate.js';
 import { securityHeadersMiddleware } from '../middleware/securityHeaders.js';
 import { createExportsCorsMiddleware } from '../middleware/cors.js';
 import { ForbiddenError, UnauthorizedError } from '../errors/index.js';
 import { encodeCursor, parseCursor } from '../lib/cursorPagination.js';
 import { logger } from '../logger.js';
 import type { ReportExporterService } from '../services/reportExporter.js';
 import type { DeveloperRepository } from '../repositories/developerRepository.js';
-
-const strictIntegerString = (field: string) =>
-  z
-    .string()
-    .trim()
-    .regex(/^\d+$/, `${field} must be an integer`);
+import { exportsQuerySchema } from '../validators/export.js';
 
 /**
- * Query parameters for listing exports
+ * Parse, validate, and normalize the export-list query string before the route
+ * executes business logic. This keeps the request boundary strict and keeps the
+ * route response contract stable for schema snapshot tests.
  */
-const exportsQuerySchema = z.object({
-  limit: strictIntegerString('limit')
-    .optional()
-    .transform((val) => (val === undefined ? 20 : Number.parseInt(val, 10)))
-    .pipe(z.number().int().min(1).max(100)),
-  offset: strictIntegerString('offset')
-    .optional()
-    .transform((val) => (val === undefined ? 0 : Number.parseInt(val, 10)))
-    .pipe(z.number().int().min(0)),
-  cursor: z.string().trim().min(1).max(2048).optional(),
-  developerId: z.string().trim().min(1).max(255).optional(),
-  format: z.enum(['csv', 'json']).optional(),
-});
-import { exportsQuerySchema } from '../validators/export.js';
-
 function parseExportsQuery(query: unknown): z.infer<typeof exportsQuerySchema> {
   const parsed = exportsQuerySchema.safeParse(query);
   if (parsed.success) {

src/validators/export.ts

@@ -1,19 +1,27 @@
 import { z } from 'zod';
 
-export const exportsQuerySchema = z.object({
-  limit: z
+/**
+ * Strict integer-string validator for query-param coercions.
+ * Rejects non-digit characters so `limit=abc` fails with a clear message.
+ */
+const strictIntegerString = (field: string) =>
+  z
     .string()
+    .trim()
+    .regex(/^\d+$/, `${field} must be an integer`);
+
+export const exportsQuerySchema = z.object({
+  limit: strictIntegerString('limit')
     .optional()
-    .transform((val) => (val ? parseInt(val, 10) : 20))
-    .pipe(z.number().int())
-    .transform((val) => Math.min(Math.max(val, 1), 100)),
-  offset: z
-    .string()
+    .transform((val) => (val === undefined ? 20 : Number.parseInt(val, 10)))
+    .pipe(z.number().int().min(1).max(100)),
+  offset: strictIntegerString('offset')
     .optional()
-    .transform((val) => (val ? parseInt(val, 10) : 0))
+    .transform((val) => (val === undefined ? 0 : Number.parseInt(val, 10)))
     .pipe(z.number().int().min(0)),
+  cursor: z.string().trim().min(1).max(2048).optional(),
   developerId: z.string().trim().min(1).max(255).optional(),
   format: z.enum(['csv', 'json']).optional(),
 });
 
-export type ExportsQueryInput = z.infer<typeof exportsQuerySchema>;
+export type ExportsQueryInput = z.infer<typeof exportsQuerySchema>;