feat(validation): enhance JSON string handling in UploadSongDto schema

- Introduce a new jsonStringField function to validate and parse JSON strings, ensuring invalid JSON surfaces as a Zod issue.
- Update thumbnailData and customInstruments fields to utilize jsonStringField for improved validation.

Author: tomast1337

packages/validation/src/common/jsonStringField.spec.ts

@@ -0,0 +1,63 @@
+import { describe, expect, it } from 'bun:test';
+
+import { z } from 'zod';
+
+import { jsonStringField } from './jsonStringField.js';
+
+describe('jsonStringField', () => {
+  it('parses a valid JSON string and validates against the inner schema', () => {
+    const schema = jsonStringField(z.array(z.string()));
+    const result = schema.safeParse('["a","b"]');
+
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data).toEqual(['a', 'b']);
+    }
+  });
+
+  it('parses a JSON object string when the inner schema is an object', () => {
+    const schema = jsonStringField(z.object({ n: z.number(), s: z.string() }));
+    const result = schema.safeParse('{"n":1,"s":"x"}');
+
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data).toEqual({ n: 1, s: 'x' });
+    }
+  });
+
+  it('turns invalid JSON into a Zod custom issue instead of throwing', () => {
+    const schema = jsonStringField(z.array(z.string()));
+    const inputs = ['{', 'not json', '', '{"unclosed": true'];
+
+    for (const input of inputs) {
+      const result = schema.safeParse(input);
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        const custom = result.error.issues.filter((i) => i.code === 'custom');
+        expect(custom.length).toBeGreaterThanOrEqual(1);
+        expect(custom.some((i) => i.message === 'Invalid JSON string')).toBe(
+          true,
+        );
+      }
+    }
+  });
+
+  it('does not classify valid JSON that fails the inner schema as invalid JSON', () => {
+    const schema = jsonStringField(z.array(z.string()));
+    const result = schema.safeParse('123');
+
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(
+        result.error.issues.some((i) => i.message === 'Invalid JSON string'),
+      ).toBe(false);
+    }
+  });
+
+  it('rejects non-string input at the outer string schema', () => {
+    const schema = jsonStringField(z.array(z.string()));
+    const result = schema.safeParse(['already', 'an', 'array'] as unknown);
+
+    expect(result.success).toBe(false);
+  });
+});

packages/validation/src/common/jsonStringField.ts

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+
+/**
+ * Multipart / form fields often arrive as JSON strings. Parses the string and
+ * validates with `schema`. Invalid JSON becomes a Zod issue (e.g. HTTP 400 via
+ * `ZodValidationPipe`) instead of a raw `SyntaxError` from `JSON.parse`.
+ */
+export function jsonStringField<T>(schema: z.ZodType<T>) {
+  return z
+    .string()
+    .transform((val, ctx) => {
+      try {
+        return JSON.parse(val) as unknown;
+      } catch {
+        ctx.addIssue({
+          code: 'custom',
+          message: 'Invalid JSON string',
+          input: val,
+        });
+        return z.NEVER;
+      }
+    })
+    .pipe(schema);
+}

packages/validation/src/index.ts

@@ -1,6 +1,7 @@
 export * from './auth/DiscordStrategyConfig.dto';
 export * from './config/EnvironmentVariables.dto';
 
+export * from './common/jsonStringField';
 export * from './common/Page.dto';
 export * from './common/PageQuery.dto';
 export * from './common/types';

packages/validation/src/song/UploadSongDto.dto.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 
+import { jsonStringField } from '../common/jsonStringField.js';
 import { UPLOAD_CONSTANTS } from '../config-shim.js';
 
 import { thumbnailDataSchema } from './ThumbnailData.dto';
@@ -31,23 +32,11 @@ export const uploadSongDtoSchema = z.object({
     categories as [string, ...string[]],
   ) as z.ZodType<CategoryType>,
   thumbnailData: z
-    .union([
-      thumbnailDataSchema,
-      z
-        .string()
-        .transform((val) => JSON.parse(val))
-        .pipe(thumbnailDataSchema),
-    ])
+    .union([thumbnailDataSchema, jsonStringField(thumbnailDataSchema)])
     .pipe(thumbnailDataSchema),
   license: z.enum(licenses as [string, ...string[]]) as z.ZodType<LicenseType>,
   customInstruments: z
-    .union([
-      z.array(z.string()),
-      z
-        .string()
-        .transform((val) => JSON.parse(val))
-        .pipe(z.array(z.string())),
-    ])
+    .union([z.array(z.string()), jsonStringField(z.array(z.string()))])
     .pipe(z.array(z.string()).max(UPLOAD_CONSTANTS.customInstruments.maxCount)),
 });