api-gateway merchant settings tests don't cover invalid business data

[therealjhay]

Problemmerchant-settings.test.ts covers happy paths; invalid names/emails/address formats pass through to the DB.

1. No format validation on settings.
2. XSS-able free-text fields unescaped at API.
3. No length caps.

Solution

• Validate settings fields (length, format).
• Escape/neutralize free text.
• Test invalid settings.

Acceptance Criteria

• Invalid settings rejected.
• Free text bounded.
• pnpm --filter api-gateway build passes.

Note for Contributors: Write a clear PR description. Show an invalid-settings rejection.

[Preciousuche]

Hi I’d like to work on #552 – api-gateway merchant settings tests don’t cover invalid business data.

I have experience contributing to backend projects with TypeScript, Node.js, and NestJS, and I’m comfortable writing and extending unit/integration tests. I’ll review the current merchant settings validation flow, identify the missing invalid business data scenarios, add comprehensive test coverage for those edge cases, and ensure the existing test suite continues to pass without introducing regressions.

I’ll keep the implementation focused, follow the project’s coding and testing conventions, and submit a clean PR with clear explanations of the added test cases.

I’d appreciate being assigned this issue. Thanks!

[grantfox-oss]

🦊 GrantFox — @Preciousuche has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #552)
2. Your PR will be reviewed by the Betta-Pay maintainers

Good luck! Track your progress on GrantFox.