ci: fix pipeline errors and enforce route lint validatation

.github/workflows/npm-publish.yml

@@ -57,17 +57,18 @@ jobs:
       - name: Resolve version and dist-tag
         id: resolve
         run: |
-          case "${{ github.event_name }}" in
-            workflow_dispatch|workflow_call)
-              VERSION="${{ inputs.version }}"
-              TAG="${{ inputs.tag }}"
-              ;;
-            release)
+          VERSION="${{ inputs.version }}"
+          TAG="${{ inputs.tag }}"
+
+          if [ -z "$VERSION" ]; then
+            if [ "${{ github.event_name }}" = "release" ]; then
               VERSION="${GITHUB_REF_NAME}"
-              ;;
-          esac
+            fi
+          fi
+
           # Strip v prefix if present
           VERSION="${VERSION#v}"
+
           # Default dist-tag logic
           if [ -z "$TAG" ]; then
             if [[ "$VERSION" == *-* ]]; then

src/app/api/settings/cache-config/route.ts

@@ -1,6 +1,17 @@
 import { NextRequest, NextResponse } from "next/server";
 import { getSettings, updateSettings } from "@/lib/localDb";
 import { isAuthenticated } from "@/shared/utils/apiAuth";
+import { z } from "zod";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+
+const cacheConfigUpdateSchema = z.object({
+  semanticCacheEnabled: z.boolean().optional(),
+  semanticCacheMaxSize: z.number().positive().optional(),
+  semanticCacheTTL: z.number().positive().optional(),
+  promptCacheEnabled: z.boolean().optional(),
+  promptCacheStrategy: z.enum(["auto", "system-only", "manual"]).optional(),
+  alwaysPreserveClientCache: z.enum(["auto", "always", "never"]).optional(),
+});
 
 const CACHE_CONFIG_KEYS = [
   "semanticCacheEnabled",
@@ -43,25 +54,37 @@ export async function PUT(request: NextRequest) {
   }
 
   try {
-    const body = await request.json();
-    const updates: Record<string, unknown> = {};
+    let rawBody: unknown;
+    try {
+      rawBody = await request.json();
+    } catch {
+      return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+    }
 
-    if (typeof body.semanticCacheEnabled === "boolean") {
+    const validation = validateBody(cacheConfigUpdateSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return validation.response;
+    }
+
+    const updates: Record<string, unknown> = {};
+    const body = validation.data;
+
+    if (body.semanticCacheEnabled !== undefined) {
       updates.semanticCacheEnabled = body.semanticCacheEnabled;
     }
-    if (typeof body.semanticCacheMaxSize === "number" && body.semanticCacheMaxSize > 0) {
+    if (body.semanticCacheMaxSize !== undefined) {
       updates.semanticCacheMaxSize = body.semanticCacheMaxSize;
     }
-    if (typeof body.semanticCacheTTL === "number" && body.semanticCacheTTL > 0) {
+    if (body.semanticCacheTTL !== undefined) {
       updates.semanticCacheTTL = body.semanticCacheTTL;
     }
-    if (typeof body.promptCacheEnabled === "boolean") {
+    if (body.promptCacheEnabled !== undefined) {
       updates.promptCacheEnabled = body.promptCacheEnabled;
     }
-    if (["auto", "system-only", "manual"].includes(body.promptCacheStrategy)) {
+    if (body.promptCacheStrategy !== undefined) {
       updates.promptCacheStrategy = body.promptCacheStrategy;
     }
-    if (["auto", "always", "never"].includes(body.alwaysPreserveClientCache)) {
+    if (body.alwaysPreserveClientCache !== undefined) {
       updates.alwaysPreserveClientCache = body.alwaysPreserveClientCache;
     }
 

src/app/api/tunnels/cloudflared/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { isAuthenticated } from "@/shared/utils/apiAuth";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import {
   getCloudflaredTunnelStatus,
   startCloudflaredTunnel,
@@ -40,27 +41,27 @@ export async function POST(request: NextRequest) {
     return unauthorized();
   }
 
-  let payload: unknown;
+  let rawBody: unknown;
   try {
-    payload = await request.json();
+    rawBody = await request.json();
   } catch {
     return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
   }
 
-  const parsed = actionSchema.safeParse(payload);
-  if (!parsed.success) {
-    return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
+  const validation = validateBody(actionSchema, rawBody);
+  if (isValidationFailure(validation)) {
+    return validation.response;
   }
 
+  const parsed = validation.data;
+
   try {
     const status =
-      parsed.data.action === "enable"
-        ? await startCloudflaredTunnel()
-        : await stopCloudflaredTunnel();
+      parsed.action === "enable" ? await startCloudflaredTunnel() : await stopCloudflaredTunnel();
 
     return NextResponse.json({
       success: true,
-      action: parsed.data.action,
+      action: parsed.action,
       status,
     });
   } catch (error) {