feat: enhance attribute value resolution to prefer request-scoped files for empty data fields

Author: 3m1n3nc3

package.json

@@ -1,6 +1,6 @@
 {
   "name": "kanun",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "Framework-agnostic TypeScript-first validation library.",
   "type": "module",
   "files": [

src/BaseValidator.ts

@@ -692,15 +692,21 @@ export class BaseValidator<D extends GenericObject = GenericObject> {
 
     /**
      * Resolve an attribute value from validator data first, then request-scoped file context.
+     * When the data value is empty (null or empty string), prefer a file from requestFiles
+     * because framework body-parsers commonly set file input fields to '' or null.
+     * 
+     * @param attribute 
+     * @returns 
      */
     private getAttributeValue (attribute: string): any {
         const dataValue = deepFind(this.data, attribute)
+        const fileValue = deepFind(this.getContext().requestFiles ?? {}, attribute)
 
-        if (typeof dataValue !== 'undefined') {
-            return dataValue
+        if (typeof fileValue !== 'undefined' && (typeof dataValue === 'undefined' || dataValue === null || dataValue === '')) {
+            return fileValue
         }
 
-        return deepFind(this.getContext().requestFiles ?? {}, attribute)
+        return dataValue
     }
 
 

src/validators/validateAttributes.ts

@@ -1056,12 +1056,13 @@ class validateAttributes {
 
     private getAttributeValue (attribute: string): any {
         const dataValue = deepFind(this.data, attribute)
+        const fileValue = deepFind(this.context.requestFiles ?? {}, attribute)
 
-        if (typeof dataValue !== 'undefined') {
-            return dataValue
+        if (typeof fileValue !== 'undefined' && (typeof dataValue === 'undefined' || dataValue === null || dataValue === '')) {
+            return fileValue
         }
 
-        return deepFind(this.context.requestFiles ?? {}, attribute)
+        return dataValue
     }
 
     private getDistinctValues (primaryAttribute: string): any[] {

test.cjs

@@ -0,0 +1,87 @@
+const { createServer } = require('node:http')
+const { useExpressUploadContext, fileValidatorPlugin } = require('./packages/file/dist')
+
+const { Validator, } = require('./dist')
+const express = require('express')
+const multer = require('multer')
+Validator.use(fileValidatorPlugin)
+
+async function listenHttpServer (handler) {
+    const server = createServer(handler)
+
+    await new Promise((resolve, reject) => {
+        server.once('error', reject)
+        server.listen(0, '127.0.0.1', () => {
+            server.off('error', reject)
+            resolve()
+        })
+    })
+
+    const address = server.address()
+
+    if (!address || typeof address === 'string') {
+        throw new Error('Could not determine server address.')
+    }
+
+    return {
+        close: async () => {
+            await new Promise((resolve, reject) => {
+                server.close(error => {
+                    if (error) {
+                        reject(error)
+                        return
+                    }
+
+                    resolve()
+                })
+            })
+        },
+        url: `http://127.0.0.1:${(address).port}`,
+    }
+}
+
+const test = async () => {
+    const app = express()
+    const upload = multer({ storage: multer.memoryStorage() })
+
+    const png1x1 = Buffer.from(
+        'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAusB9WlH0b8AAAAASUVORK5CYII=',
+        'base64',
+    )
+
+
+    app.use(upload.single('avatar'))
+    app.use(function (request, _response, next) {
+        useExpressUploadContext(request)
+        next()
+    })
+
+    app.post('/middleware-required-global', async function (_request, response) {
+        const validated = await Validator
+            .make({}, { avatar: 'required|file|image|mimes:png' })
+            .validate()
+
+        response.json({
+            hasAvatar: Object.prototype.hasOwnProperty.call(validated, 'avatar'),
+        })
+    })
+
+
+    const server = await listenHttpServer(app)
+
+    try {
+        const formData = new FormData()
+        formData.append('avatar', new File([png1x1], 'avatar.png', { type: 'image/png' }))
+
+        const response = await fetch(`${server.url}/middleware-required-global`, {
+            body: formData,
+            method: 'POST',
+        })
+
+        console.log(await response.text())
+    } finally {
+        await server.close()
+    }
+}
+
+test().catch(console.error)

tests/file-plugin-validator.test.ts

@@ -30,7 +30,7 @@ const png1x1 = Buffer.from(
     'base64',
 )
 
-async function listenHttpServer (handler: RequestListener) {
+export async function listenHttpServer (handler: RequestListener) {
     const server = createServer(handler)
 
     await new Promise<void>((resolve, reject) => {
@@ -201,6 +201,46 @@ describe('File validator plugin', function () {
         assert.deepEqual(await validator.validate(), { avatar })
     })
 
+    it('treats request-scoped files as present when data has empty string for field', async () => {
+        const avatar = {
+            buffer: png1x1,
+            mimetype: 'image/png',
+            originalname: 'avatar.png',
+            size: 2048,
+        }
+
+        const validator = Validator.make(
+            { avatar: '' } as any,
+            {
+                avatar: ['required', 'file', 'image', 'extensions:png'],
+            },
+        ).withContext({
+            requestFiles: { avatar },
+        })
+
+        assert.equal(await validator.passes(), true)
+    })
+
+    it('treats request-scoped files as present when data has null for field', async () => {
+        const avatar = {
+            buffer: png1x1,
+            mimetype: 'image/png',
+            originalname: 'avatar.png',
+            size: 2048,
+        }
+
+        const validator = Validator.make(
+            { avatar: null } as any,
+            {
+                avatar: ['required', 'file', 'image', 'extensions:png'],
+            },
+        ).withContext({
+            requestFiles: { avatar },
+        })
+
+        assert.equal(await validator.passes(), true)
+    })
+
     it('still fails the required rule when a request-scoped file is missing', async () => {
         const validator = Validator.make(
             {},