Add strict request validation for POST /v1/access/check

[Lakes41]

Difficulty: Intermediate
Type: bug

Background
POST /v1/access/check takes { wallet, communityId, resource } and returns an allow/deny decision — this is the core access-decision endpoint feeding the policy engine.

Problem
Without strict schema validation, malformed input (invalid wallet format, missing communityId, unexpected resource shapes) can reach the policy engine and produce ambiguous or misleading decisions instead of a clear 400 error.

Expected outcome
The route validates wallet (checksummed/lowercased EVM address format), communityId (valid UUID/ID format matching the schema), and resource against a strict schema before reaching the policy engine, returning descriptive 400 errors on failure.

Suggested implementation

• Add a Zod (or Fastify JSON-schema) validator for the request body in the access-check route.
• Normalize wallet addresses (lowercase or checksum) before querying, consistent with how they're stored via Prisma.
• Add explicit error messages per invalid field (not a generic "bad request").
• Add unit tests covering missing fields, malformed wallet, and unknown communityId.

Acceptance criteria

• Invalid wallet format returns 400 with a clear message
• Missing communityId or resource returns 400
• Valid requests behave exactly as before
• OpenAPI spec regenerated and committed

Likely affected files/directories

• apps/access-api/src/routes/ (access/check route)
• packages/shared-types/
• docs/openapi.json

[EmmanuelAdah]

Hi, I’d love to take this on.
Drawing on my backend experience with strict Node.js and TypeScript APIs, I will define a shared Zod schema in packages/shared-types to rigorously validate the payload and normalize EVM wallet addresses before they reach Prisma. I'll wire this into the access/check route to guarantee descriptive, field-level 400 (Bad Request) errors for any malformed inputs, add the necessary unit tests for edge cases, and regenerate the OpenAPI spec.
I would really appreciate if given the opportunity to resolve this issue. Thanks

[grantfox-oss]

🦊 GrantFox — @EmmanuelAdah has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #260)
2. Your PR will be reviewed by the Adamantine-guild maintainers

Good luck! Track your progress on GrantFox.