feat: add ajv validation (MAPCO-6820)

.release-please-manifest.json

@@ -1 +1 @@
-{".":"1.0.0"}
+{ ".": "1.0.0" }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "feedback-api",
-  "version": "1.0.0",
+  "version": "0.2.1",
   "description": "Feedback-api service for MapColonies",
   "main": "./src/index.ts",
   "scripts": {
@@ -55,7 +55,9 @@
     "@map-colonies/tsconfig": "^2.0.0",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-metrics": "0.23.0",
+    "@sinclair/typebox": "^0.34.49",
     "@types/body-parser": "^1.19.6",
+    "ajv": "^8.20.0",
     "compression": "^1.8.0",
     "express": "^4.21.2",
     "express-openapi-validator": "^5.6.2",

src/common/errors.ts

@@ -24,3 +24,11 @@ export class BadRequestError extends Error implements HttpError {
     super(message);
   }
 }
+
+export class GeocodingResponseParseError extends Error {
+  public constructor(message: string) {
+    super(message);
+    Object.setPrototypeOf(this, GeocodingResponseParseError.prototype);
+    this.name = 'GeocodingResponseParseError';
+  }
+}

src/common/interfaces.ts

@@ -1,3 +1,4 @@
+import { Type, type Static } from '@sinclair/typebox';
 import type { vectorFeedbackApiV1Type } from '@map-colonies/schemas';
 
 export interface OpenApiConfig {
@@ -17,11 +18,13 @@ export interface FeedbackResponse {
   geocodingResponse: GeocodingResponse;
 }
 
-export interface GeocodingResponse {
-  userId?: string;
-  apiKey: string;
-  site: string;
-  response: JSON;
-  respondedAt: Date; // from Geocoding
-  wasUsed?: boolean;
-}
+export const geocodingResponseSchema = Type.Object({
+  userId: Type.Optional(Type.String()),
+  apiKey: Type.String(),
+  site: Type.String(),
+  response: Type.Any(),
+  respondedAt: Type.Unsafe<Date>({ type: 'string' }),
+  wasUsed: Type.Optional(Type.Boolean()),
+});
+
+export type GeocodingResponse = Static<typeof geocodingResponseSchema>;

src/common/utils.ts

@@ -1,4 +1,17 @@
-import { TimeoutError } from './errors';
+import ajvLib from 'ajv';
+import { GeocodingResponseParseError, TimeoutError } from './errors';
+import { geocodingResponseSchema, type GeocodingResponse } from './interfaces';
+
+const ajv = new ajvLib();
+const validateGeocodingResponse = ajv.compile<GeocodingResponse>(geocodingResponseSchema);
+
+export function parseGeocodingResponse(data: string): GeocodingResponse | GeocodingResponseParseError {
+  const parsed: unknown = JSON.parse(data);
+  if (!validateGeocodingResponse(parsed)) {
+    return new GeocodingResponseParseError(`Invalid geocoding response shape: ${ajv.errorsText(validateGeocodingResponse.errors)}`);
+  }
+  return parsed;
+}
 
 export const promiseTimeout = async <T>(ms: number, promise: Promise<T>): Promise<T> => {
   // create a promise that rejects in <ms> milliseconds

src/feedback/models/feedbackManager.ts

@@ -3,7 +3,8 @@ import { inject, injectable } from 'tsyringe';
 import { type Producer } from 'kafkajs';
 import { SERVICES } from '@common/constants';
 import { FeedbackResponse, GeocodingResponse } from '@common/interfaces';
-import { NotFoundError, BadRequestError } from '@common/errors';
+import { parseGeocodingResponse } from '@common/utils';
+import { NotFoundError, BadRequestError, GeocodingResponseParseError } from '@common/errors';
 import { type ConfigType } from '@src/common/config';
 import { type RedisClient } from '../../redis';
 import { IFeedbackModel } from './feedback';
@@ -20,12 +21,11 @@ export class FeedbackManager {
   public async createFeedback(feedback: IFeedbackModel, apiKey: string): Promise<FeedbackResponse> {
     const requestId = feedback.request_id;
     const userId = feedback.user_id;
-    const raw = this.config.get('application.userValidation');
-    const userValidation = Array.isArray(raw) ? raw : (JSON.parse(raw) as string[]);
+    const userValidation = this.config.get('application.userValidation');
     const ttl = this.config.get('redis.ttl');
     const prefix = this.config.get('redis.prefix');
 
-    const validateUser = !userValidation.some((validEnding) => validEnding !== '' && userId.endsWith(validEnding));
+    const validateUser = !userValidation.some((validEnding: string) => validEnding !== '' && userId.endsWith(validEnding));
     if (validateUser) {
       throw new BadRequestError(`user_id not valid. valid user_id ends with "${JSON.stringify(userValidation)}"`);
     }
@@ -49,9 +49,18 @@ export class FeedbackManager {
 
   public async getGeocodingResponse(requestId: string, userId: string, apiKey: string): Promise<GeocodingResponse> {
     try {
-      const redisResponse = (await this.redisClient.get(requestId)) as string;
-      if (redisResponse) {
-        const geocodingResponse = JSON.parse(redisResponse) as GeocodingResponse;
+      const redisResponse = await this.redisClient.get(requestId);
+      if (redisResponse != null) {
+        const geocodingResponse = parseGeocodingResponse(redisResponse);
+
+        if (geocodingResponse instanceof GeocodingResponseParseError) {
+          this.logger.error({
+            msg: `Error parsing geocoding response for requestId: ${requestId}, error: ${geocodingResponse.message} }`,
+            err: geocodingResponse,
+          });
+          throw geocodingResponse;
+        }
+
         geocodingResponse.userId = userId;
         geocodingResponse.apiKey = apiKey;
         geocodingResponse.wasUsed = true;

src/redis/subscribe.ts

@@ -4,7 +4,8 @@ import type { Producer } from 'kafkajs';
 import type { ConfigType } from '@src/common/config';
 import { REDIS_SUB, SERVICES } from '../common/constants';
 import type { FeedbackResponse, GeocodingResponse } from '../common/interfaces';
-import { NotFoundError } from '../common/errors';
+import { parseGeocodingResponse } from '../common/utils';
+import { GeocodingResponseParseError, NotFoundError } from '../common/errors';
 import type { RedisClient } from '../redis/index';
 
 const TTL_PREFIX = 'ttl:';
@@ -65,10 +66,15 @@ export const redisSubscribe = async (deps: DependencyContainer): Promise<RedisCl
     try {
       if (message.startsWith(prefixWithTtl) && redisClient.isOpen) {
         const geocodingMessage = message.substring(prefixWithTtl.length);
-
         const redisResponse = await redisClient.get(geocodingMessage);
         if (redisResponse !== null) {
-          const geocodingResponse = JSON.parse(redisResponse) as GeocodingResponse;
+          const geocodingResponse = parseGeocodingResponse(redisResponse);
+
+          if (geocodingResponse instanceof GeocodingResponseParseError) {
+            logger.error({ msg: `Error parsing geocoding response error: ${geocodingResponse.message} }`, err: geocodingResponse });
+            throw geocodingResponse;
+          }
+
           if (!(geocodingResponse.wasUsed ?? false)) {
             await sendNoChosenResult(geocodingMessage, logger, config, kafkaProducer, redisClient);
           }
@@ -104,7 +110,16 @@ export const getNoChosenGeocodingResponse = async (requestId: string, logger: Lo
   try {
     const redisResponse = await redisClient.get(requestId);
     if (redisResponse != null) {
-      const geocodingResponse = JSON.parse(redisResponse) as GeocodingResponse;
+      const geocodingResponse = parseGeocodingResponse(redisResponse);
+
+      if (geocodingResponse instanceof GeocodingResponseParseError) {
+        logger.error({
+          msg: `Error parsing geocoding response for requestId: ${requestId}, error: ${geocodingResponse.message} }`,
+          err: geocodingResponse,
+        });
+        throw geocodingResponse;
+      }
+
       return geocodingResponse;
     }
   } catch (error) {

tests/helpers/createMock.ts

@@ -1,3 +1,13 @@
 import type { Mock, MockedObject } from 'vitest';
+import type { GeocodingResponse } from '@common/interfaces';
 
 export const createMock = <T>(partial: Partial<Record<keyof T, Mock>>): MockedObject<T> => partial as MockedObject<T>;
+
+export const makeGeocodingResponseJson = (overrides: Partial<GeocodingResponse> = {}): string =>
+  JSON.stringify({
+    apiKey: 'test-api-key',
+    site: 'test-site',
+    response: {},
+    respondedAt: '2024-01-01T00:00:00.000Z',
+    ...overrides,
+  });