chore: backend auth validation and StrapiClientService cleanup

apps/backend/package.json

@@ -87,6 +87,8 @@
     "@nestjs/core": "^11.0.0",
     "@nestjs/platform-express": "^11.0.0",
     "@org/shared-types": "^0.0.1",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.14.0",
     "reflect-metadata": "^0.1.13",
     "rxjs": "^7.8.0",
     "tslib": "^2.3.0"

apps/backend/src/app/auth/auth.controller.ts

@@ -1,20 +1,20 @@
 import { Controller, Post, Body } from '@nestjs/common';
 import { AuthService } from './auth.service';
+import { LoginDto } from './dto/login.dto';
+import { RegisterDto } from './dto/register.dto';
 import type { AuthResponse } from '@org/shared-types';
 
 @Controller('auth')
 export class AuthController {
   constructor(private readonly authService: AuthService) {}
 
   @Post('login')
-  login(@Body() body: { email: string; password: string }): Promise<AuthResponse> {
-    return this.authService.login(body.email, body.password);
+  login(@Body() dto: LoginDto): Promise<AuthResponse> {
+    return this.authService.login(dto.email, dto.password);
   }
 
   @Post('register')
-  register(
-    @Body() body: { name: string; email: string; password: string },
-  ): Promise<AuthResponse> {
-    return this.authService.register(body.name, body.email, body.password);
+  register(@Body() dto: RegisterDto): Promise<AuthResponse> {
+    return this.authService.register(dto.name, dto.email, dto.password);
   }
 }

apps/backend/src/app/auth/dto/login.dto.ts

@@ -0,0 +1,10 @@
+import { IsEmail, IsString, MinLength } from 'class-validator';
+
+export class LoginDto {
+  @IsEmail()
+  email: string;
+
+  @IsString()
+  @MinLength(1)
+  password: string;
+}

apps/backend/src/app/auth/dto/register.dto.ts

@@ -0,0 +1,14 @@
+import { IsEmail, IsString, MinLength } from 'class-validator';
+
+export class RegisterDto {
+  @IsString()
+  @MinLength(1)
+  name: string;
+
+  @IsEmail()
+  email: string;
+
+  @IsString()
+  @MinLength(6)
+  password: string;
+}

apps/backend/src/app/strapi-client/strapi-client.service.ts

@@ -25,34 +25,28 @@ export class StrapiClientService {
     }
   }
 
-  async get<T>(path: string): Promise<T[]> {
-    const res = await this.request(path);
-    if (!res.ok) {
-      throw new ServiceUnavailableException(`Strapi returned ${res.status}`);
-    }
-    let body: StrapiListResponse<T>;
+  private async parseJson<T>(res: Response): Promise<T> {
     try {
-      body = (await res.json()) as StrapiListResponse<T>;
+      return (await res.json()) as T;
     } catch {
       throw new ServiceUnavailableException('Strapi returned invalid JSON');
     }
-    return body.data ?? [];
   }
 
-  async getById<T>(path: string): Promise<T> {
+  async get<T>(path: string): Promise<T[]> {
     const res = await this.request(path);
-    if (res.status === 404) {
-      throw new NotFoundException('Resource not found');
-    }
     if (!res.ok) {
       throw new ServiceUnavailableException(`Strapi returned ${res.status}`);
     }
-    let body: StrapiSingleResponse<T>;
-    try {
-      body = (await res.json()) as StrapiSingleResponse<T>;
-    } catch {
-      throw new ServiceUnavailableException('Strapi returned invalid JSON');
-    }
+    const body = await this.parseJson<StrapiListResponse<T>>(res);
+    return body.data ?? [];
+  }
+
+  async getById<T>(path: string): Promise<T> {
+    const res = await this.request(path);
+    if (res.status === 404) throw new NotFoundException('Resource not found');
+    if (!res.ok) throw new ServiceUnavailableException(`Strapi returned ${res.status}`);
+    const body = await this.parseJson<StrapiSingleResponse<T>>(res);
     return body.data;
   }
 
@@ -70,12 +64,6 @@ export class StrapiClientService {
       } catch { /* ignore */ }
       throw new HttpException({ message }, res.status);
     }
-    let result: T;
-    try {
-      result = (await res.json()) as T;
-    } catch {
-      throw new ServiceUnavailableException('Strapi returned invalid JSON');
-    }
-    return result;
+    return this.parseJson<T>(res);
   }
 }

apps/backend/src/main.ts

@@ -3,13 +3,14 @@
  * This is only a minimal backend to get started.
  */
 
-import { Logger } from '@nestjs/common';
+import { Logger, ValidationPipe } from '@nestjs/common';
 import { NestFactory } from '@nestjs/core';
 import { AppModule } from './app/app.module';
 
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
   app.enableCors({ origin: process.env['CORS_ORIGIN'] ?? 'http://localhost:3000' });
+  app.useGlobalPipes(new ValidationPipe({ whitelist: true }));
   const globalPrefix = 'api';
   app.setGlobalPrefix(globalPrefix);
   const port = process.env.PORT || 3000;