Atakan Doğan Özban
d74c422de6
Replace forgeable cookie auth with signed JWT sessions, protect admin APIs, add input validation, and improve Docker deployment config.
25 lines
797 B
TypeScript
25 lines
797 B
TypeScript
import { z } from "zod";
|
|
|
|
export const MAX_GPX_BYTES = 5 * 1024 * 1024; // 5 MB
|
|
|
|
export const locationSchema = z.object({
|
|
title: z.string().trim().min(1, "Title is required").max(200),
|
|
city: z.string().trim().min(1, "City is required").max(200),
|
|
tags: z.string().max(500).default(""),
|
|
captureDate: z
|
|
.string()
|
|
.refine((d) => !isNaN(Date.parse(d)), "Invalid capture date"),
|
|
visibility: z.enum(["public", "unlisted"]).default("public"),
|
|
gpxData: z
|
|
.string()
|
|
.max(MAX_GPX_BYTES, `GPX data must be under ${MAX_GPX_BYTES / (1024 * 1024)} MB`)
|
|
.optional()
|
|
.nullable(),
|
|
});
|
|
|
|
export type LocationInput = z.infer<typeof locationSchema>;
|
|
|
|
export function parseLocationBody(body: unknown) {
|
|
return locationSchema.safeParse(body);
|
|
}
|