fix: minor bugfixes (#683)

* feat: using zod

* feat: client-side validation

* feat: changeset

Author: q1zhen

.changeset/big-peaches-warn.md

@@ -0,0 +1,5 @@
+---
+"enspire": patch
+---
+
+validation fixes and interface logic fixes

app/components/custom/club-file-upload.vue

@@ -72,21 +72,35 @@ function readFileAsDataURL(file: File) {
   })
 }
 
+const formSchema = z.object({
+  clubId: z.number().int(),
+  collectionId: z.string(),
+  fileContent: z.string(),
+  rawName: z.string().max(256),
+})
+
 const onSubmit = form.handleSubmit(async (values) => {
   submitting.value = true
   const fileName = values.file.name
-  const status = await $fetch('/api/files/new-record', {
-    method: 'POST',
-    body: {
-      clubId: Number.parseInt(props.club),
-      collectionId: props.collection,
-      fileContent: await readFileAsDataURL(values.file),
-      rawName: fileName,
-    },
-  })
-  form.resetForm()
-  inputKey.value = uuidv4()
-  msg.value = (status && status.success) ? `${fileName} (提交成功)` : '提交失败'
+  const data = {
+    clubId: Number.parseInt(props.club),
+    collectionId: props.collection,
+    fileContent: await readFileAsDataURL(values.file),
+    rawName: fileName,
+  }
+  if (formSchema.safeParse(data).success) {
+    const status = await $fetch('/api/files/new-record', {
+      method: 'POST',
+      body: data,
+    })
+    form.resetForm()
+    inputKey.value = uuidv4()
+    await updateClub()
+    msg.value = (status && status.success) ? `${fileName} (提交成功)` : '提交失败'
+  }
+  else {
+    msg.value = '文件内容异常'
+  }
   submitting.value = false
 })
 
@@ -173,7 +187,7 @@ await updateClub()
         </FormItem>
       </FormField>
       <div class="mt-2">
-        <Button type="submit" variant="secondary" :disabled="!form.values.file || submitting || clubUpdating">
+        <Button type="submit" variant="secondary" :disabled="!form.values.file || submitting || clubUpdating || !props.club">
           上传
         </Button>
         <Button v-if="currentClubData" :disabled="downloading" variant="outline" class="ml-2" type="button" @click="download">

server/api/files/new-record.post.ts

@@ -1,5 +1,6 @@
 import { PrismaClient } from '@prisma/client'
 import { randomUUID } from 'uncrypto'
+import { z } from 'zod'
 
 interface Body {
   clubId: number
@@ -8,6 +9,13 @@ interface Body {
   rawName: string
 }
 
+const bodySchema = z.object({
+  clubId: z.number().int(),
+  collectionId: z.string(),
+  fileContent: z.string(),
+  rawName: z.string().max(256),
+})
+
 const prisma = new PrismaClient()
 
 export default eventHandler(async (event) => {
@@ -19,6 +27,12 @@ export default eventHandler(async (event) => {
 
   return readBody(event)
     .then(async (body: Body) => {
+      if (!bodySchema.safeParse(body).success) {
+        return {
+          success: false,
+          error: 'Invalid file given',
+        }
+      }
       const { clubId, collectionId, fileContent, rawName } = body
       // TODO: this should be enabled after the ID mismatch is fixed
       // const collectionInfo = await prisma.fileCollection.findFirst({