[CAL-3977] Zod Errors in any /payments and /payments/[id] API Endpoints about cal.com

[dosubot]

To resolve the Zod errors encountered when making requests to the /payments and /payments/[id] API endpoints, ensure that the query parameters and the response data conform to the expected schema definitions. Here is a step-by-step approach to troubleshoot and resolve the Zod errors:

1. Validate Query Parameters: Ensure that the query parameters passed to the API endpoints match the expected schema. The schemaQueryIdParseInt schema is used to validate and parse the id parameter.

2. Validate Response Data: Ensure that the response data from the database matches the schemaPaymentPublic schema. This schema is used to validate the payment data before sending it in the response. Note that the schemaPaymentPublic schema omits the externalId field from the payment data.

3. Error Handling: Properly handle and log errors to understand the cause of the Zod validation failures. Implement a Zod exception filter to catch and log detailed error information.

Here is the relevant code snippet with comments to help you understand the validation process:

import type { NextApiRequest, NextApiResponse } from "next";
import prisma from "@calcom/prisma";
import { withMiddleware } from "~/lib/helpers/withMiddleware";
import type { PaymentResponse } from "~/lib/types";
import { schemaPaymentPublic } from "~/lib/validations/payment";
import {
  schemaQueryIdParseInt,
  withValidQueryIdTransformParseInt,
} from "~/lib/validations/shared/queryIdTransformParseInt";

/**
 * @swagger
 * /payments/{id}:
 *   get:
 *     summary: Find a payment
 *     parameters:
 *       - in: query
 *         name: apiKey
 *         required: true
 *         schema:
 *           type: string
 *         description: Your API key
 *       - in: path
 *         name: id
 *         schema:
 *           type: integer
 *         required: true
 *         description: ID of the payment to get
 *     tags:
 *     - payments
 *     responses:
 *       200:
 *         description: OK
 *       401:
 *        description: Authorization information is missing or invalid.
 *       404:
 *         description: Payment was not found
 */
export async function paymentById(
  { method, query, userId }: NextApiRequest,
  res: NextApiResponse<PaymentResponse>
) {
  // Validate and parse the query parameters
  const safeQuery = schemaQueryIdParseInt.safeParse(query);
  if (safeQuery.success && method === "GET") {
    const userWithBookings = await prisma.user.findUnique({
      where: { id: userId },
      include: { bookings: true },
    });

    // Fetch and validate the payment data
    await prisma.payment
      .findUnique({ where: { id: safeQuery.data.id } })
      .then((data) => schemaPaymentPublic.parse(data))
      .then((payment) => {
        // Check if the user is authorized to view the payment
        if (!userWithBookings?.bookings.map((b) => b.id).includes(payment.bookingId)) {
          res.status(401).json({ message: "Unauthorized" });
        } else {
          res.status(200).json({ payment });
        }
      })
      .catch((error: Error) =>
        res.status(404).json({
          message: `Payment with id: ${safeQuery.data.id} not found`,
          error,
        })
      );
  } else {
    // Handle invalid query parameters
    res.status(400).json({ message: "Invalid query parameters" });
  }
}

export default withMiddleware("HTTP_GET")(withValidQueryIdTransformParseInt(paymentById));

Additionally, implement a Zod exception filter to catch and log detailed error information:

import type { ArgumentsHost, ExceptionFilter } from "@nestjs/common";
import { Catch, HttpStatus, Logger } from "@nestjs/common";
import { Request } from "express";
import { ZodError } from "zod";

import { BAD_REQUEST, ERROR_STATUS } from "@calcom/platform-constants";
import { Response } from "@calcom/platform-types";

@Catch(ZodError)
export class ZodExceptionFilter implements ExceptionFilter {
  private readonly logger = new Logger("ZodExceptionFilter");

  catch(error: ZodError, host: ArgumentsHost) {
    const ctx = host.switchToHttp();
    const response = ctx.getResponse<Response>();
    const request = ctx.getRequest<Request>();
    const requestId = request.headers["X-Request-Id"];

    this.logger.error(`ZodError: ${error.message}`, {
      error,
      body: request.body,
      headers: request.headers,
      url: request.url,
      method: request.method,
      requestId,
    });

    response.status(HttpStatus.BAD_REQUEST).json({
      status: ERROR_STATUS,
      timestamp: new Date().toISOString(),
      path: request.url,
      error: {
        code: BAD_REQUEST,
        message: error.issues.reduce(
          (acc, issue) => `${issue.path.join(".")} - ${issue.message}, ${acc}`,
          ""
        ),
      },
    });
  }
}

Ensure that the id parameter in the query is an integer and that the payment data returned from the database matches the schemaPaymentPublic schema, which omits the externalId field. If there are any discrepancies, adjust the input data or the schema definitions accordingly ^[1][2][3].

To continue talking to Dosu, mention @dosu.

[stefanmuljadi]

Second this! Happens on both endpoints for me as well. It seems like an issue/error occurs when running the parse function of _paymentModel in @calcom/prisma/zod. because of data type differences. Critical issue for us since we can't retrieve payment UID for abandoned carts payment links and other payment details for internal reference.