refactor: Zod schemas and unified body validation (#356)

[DammyAji]

Summary

Closes #356

Centralizes request body validation on Zod schemas with a single validateBody(schema) middleware producing uniform error envelopes across all routes.

Changes

• zod@3.24.2 added as a dependency
• src/middleware/validation.ts — new validateBody<T>(schema) middleware:
  • Parses body against Zod schema; unknown fields are stripped, not forwarded
  • On failure returns { success: false, code: "VALIDATION_ERROR", error, details[] }
  • Details sorted by (path ASC, rule ASC) for deterministic output
• src/middleware/schemas.ts — per-route Zod schemas:
  • CreateSlotBodySchema — professional (non-empty string), startTime/endTime (number or ISO-8601)
  • CreateBookingIntentBodySchema — slotId (slot-uuid pattern), note (optional, max 500 chars)
• src/routes/slots.ts — validateRequiredFields replaced with validateBody(CreateSlotBodySchema)
• src/routes/booking-intents.ts — parseCreateBookingIntentBody removed, validateBody(CreateBookingIntentBodySchema) added
• src/app.ts — fixed missing createCORSMiddleware import (pre-existing bug)
• src/__tests__/zod-validation.test.ts — 20 tests, all passing

Test output

PASS src/__tests__/zod-validation.test.ts
  validateBody middleware
    with CreateSlotBodySchema
      ✓ passes valid body and strips unknown fields
      ✓ returns 400 with VALIDATION_ERROR code when professional is missing
      ✓ returns 400 when professional is empty string
      ✓ returns 400 when startTime is missing
      ✓ returns 400 when endTime is an invalid string
      ✓ accepts ISO-8601 string for startTime
      ✓ returns 400 when body is not an object
      ✓ returns 400 when multiple fields are invalid and details lists all of them
      ✓ details are sorted by path ascending
    with CreateBookingIntentBodySchema
      ✓ passes valid body with slotId only
      ✓ passes valid body with slotId and note
      ✓ strips unknown fields
      ✓ returns 400 when slotId is missing
      ✓ returns 400 when slotId has invalid format
      ✓ returns 400 when note is empty string
      ✓ returns 400 when note exceeds 500 chars
      ✓ accepts note of exactly 500 chars
    validateBody on a mounted route (integration)
      ✓ returns 400 with VALIDATION_ERROR when required field is missing
      ✓ returns 400 when a field has an invalid value
      ✓ strips unknown fields and passes valid body through

Tests: 20 passed, 20 total

[drips-wave]

@DammyAji Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits