remove validateJsonBody

Author: icecrasher321

.cursor/rules/sim-architecture.mdc

@@ -61,7 +61,7 @@ Boundary HTTP request and response shapes for all routes under `apps/sim/app/api
 
 - Each contract is built with `defineRouteContract({ method, path, params?, query?, body?, headers?, response: { mode: 'json', schema } })` and exports both schemas and named TypeScript type aliases (e.g., `export type CreateFolderBody = z.input<typeof createFolderBodySchema>`).
 - Shared identifier schemas live in `apps/sim/lib/api/contracts/primitives.ts`.
-- Routes validate via canonical helpers in `apps/sim/lib/api/server/validation.ts` (`parseRequest`, `validateJsonBody`, `validateSchema`, `validationErrorResponse`, `getValidationErrorMessage`, `isZodError`). Routes never `import { z } from 'zod'` and never use `instanceof z.ZodError`.
+- Routes validate via canonical helpers in `apps/sim/lib/api/server/validation.ts` (`parseRequest`, `validateSchema`, `validationErrorResponse`, `getValidationErrorMessage`, `isZodError`). Routes never `import { z } from 'zod'` and never use `instanceof z.ZodError`.
 - Clients call `requestJson(contract, ...)` from `apps/sim/lib/api/client/request.ts`; hooks import named type aliases from contracts, never `z.input/z.output`.
 - Routes under `apps/sim/app/api/v1/**` use `apps/sim/app/api/v1/middleware.ts` for shared auth, rate-limit, and workspace access. Compose contract validation inside that middleware.
 - `bun run check:api-validation` enforces this policy and must pass on PRs.

AGENTS.md

@@ -156,7 +156,6 @@ const provider = config as unknown as LegacyProvider
 Routes never `import { z } from 'zod'` and never define route-local boundary schemas. They consume the contract from `@/lib/api/contracts/**` and validate with canonical helpers from `@/lib/api/server`:
 
 - `parseRequest(contract, request, context)` — fully contract-bound routes; parses params, query, body, and headers in one call
-- `validateJsonBody(request, schema)` — when the body schema comes from a contract but you need to assemble query/headers manually
 - `validateSchema(schema, data)` — for ad-hoc validation against a contract schema or primitive
 - `validationErrorResponse(error)` and `getValidationErrorMessage(error, fallback)` — produce 400 responses from a `ZodError`
 - `validationErrorResponseFromError(error)` — when handling unknown caught errors that may or may not be a `ZodError`
@@ -185,30 +184,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 })
 ```
 
-### Partial validation (`validateJsonBody`)
-
-```typescript
-import type { NextRequest } from 'next/server'
-import { NextResponse } from 'next/server'
-import { updateFolderBodySchema } from '@/lib/api/contracts/folders'
-import { isZodError, validateJsonBody, validationErrorResponse } from '@/lib/api/server'
-import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-
-export const PATCH = withRouteHandler(async (
-  request: NextRequest,
-  { params }: { params: Promise<{ id: string }> }
-) => {
-  const { id } = await params
-  try {
-    const body = await validateJsonBody(request, updateFolderBodySchema)
-    return NextResponse.json({ id, ...body })
-  } catch (error) {
-    if (isZodError(error)) return validationErrorResponse(error)
-    throw error
-  }
-})
-```
-
 Routes under `apps/sim/app/api/v1/**` use the shared middleware in `apps/sim/app/api/v1/middleware.ts` for auth, rate-limit, and workspace access. Compose contract validation inside that middleware — never reimplement auth/rate-limit per-route.
 
 ## Hooks

CLAUDE.md

@@ -137,7 +137,6 @@ Every API route handler must be wrapped with `withRouteHandler`. This sets up `A
 Routes never `import { z } from 'zod'` and never define route-local boundary schemas. They consume the contract from `@/lib/api/contracts/**` and validate with canonical helpers from `@/lib/api/server`:
 
 - `parseRequest(contract, request, context)` — fully contract-bound routes; parses params, query, body, and headers in one call
-- `validateJsonBody(request, schema)` — when the body schema comes from a contract but you need to assemble query/headers manually
 - `validateSchema(schema, data)` — for ad-hoc validation against a contract schema or primitive
 - `validationErrorResponse(error)` and `getValidationErrorMessage(error, fallback)` — produce 400 responses from a `ZodError`
 - `validationErrorResponseFromError(error)` — when handling unknown caught errors that may or may not be a `ZodError`
@@ -166,30 +165,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 })
 ```
 
-### Partial validation (`validateJsonBody`)
-
-```typescript
-import type { NextRequest } from 'next/server'
-import { NextResponse } from 'next/server'
-import { updateFolderBodySchema } from '@/lib/api/contracts/folders'
-import { isZodError, validateJsonBody, validationErrorResponse } from '@/lib/api/server'
-import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-
-export const PATCH = withRouteHandler(async (
-  request: NextRequest,
-  { params }: { params: Promise<{ id: string }> }
-) => {
-  const { id } = await params
-  try {
-    const body = await validateJsonBody(request, updateFolderBodySchema)
-    return NextResponse.json({ id, ...body })
-  } catch (error) {
-    if (isZodError(error)) return validationErrorResponse(error)
-    throw error
-  }
-})
-```
-
 ### Composing with other middleware
 
 ```typescript

apps/sim/AGENTS.md

@@ -107,7 +107,6 @@ const provider = config as unknown as LegacyProvider
 Routes never `import { z } from 'zod'` and never define route-local boundary schemas. They consume the contract from `@/lib/api/contracts/**` and validate with canonical helpers from `@/lib/api/server`:
 
 - `parseRequest(contract, request, context)` — fully contract-bound routes; parses params, query, body, and headers in one call.
-- `validateJsonBody(request, schema)` — when the body schema comes from a contract but you need to assemble query/headers manually.
 - `validateSchema(schema, data)` — for ad-hoc validation against a contract schema or primitive.
 - `validationErrorResponse(error)` and `getValidationErrorMessage(error, fallback)` — produce 400 responses from a `ZodError`.
 - `validationErrorResponseFromError(error)` — when handling unknown caught errors that may or may not be a `ZodError`.
@@ -136,30 +135,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 })
 ```
 
-### Partial validation (`validateJsonBody`)
-
-```typescript
-import type { NextRequest } from 'next/server'
-import { NextResponse } from 'next/server'
-import { updateFolderBodySchema } from '@/lib/api/contracts/folders'
-import { isZodError, validateJsonBody, validationErrorResponse } from '@/lib/api/server'
-import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-
-export const PATCH = withRouteHandler(async (
-  request: NextRequest,
-  { params }: { params: Promise<{ id: string }> }
-) => {
-  const { id } = await params
-  try {
-    const body = await validateJsonBody(request, updateFolderBodySchema)
-    return NextResponse.json({ id, ...body })
-  } catch (error) {
-    if (isZodError(error)) return validationErrorResponse(error)
-    throw error
-  }
-})
-```
-
 Routes under `apps/sim/app/api/v1/**` use the shared middleware in `apps/sim/app/api/v1/middleware.ts` for auth, rate-limit, and workspace access. Compose contract validation inside that middleware — never reimplement auth/rate-limit per-route.
 
 ## React Query Client Boundary

apps/sim/app/api/a2a/agents/[agentId]/route.ts

@@ -7,10 +7,10 @@ import { generateAgentCard, generateSkillsFromWorkflow } from '@/lib/a2a/agent-c
 import type { AgentCapabilities, AgentSkill } from '@/lib/a2a/types'
 import {
   a2aAgentParamsSchema,
-  publishA2AAgentBodySchema,
-  updateA2AAgentBodySchema,
+  publishA2AAgentContract,
+  updateA2AAgentContract,
 } from '@/lib/api/contracts/a2a-agents'
-import { getValidationErrorMessage, validateJsonBody } from '@/lib/api/server'
+import { parseRequest } from '@/lib/api/server'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { getRedisClient } from '@/lib/core/config/redis'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -117,18 +117,9 @@ export const PUT = withRouteHandler(
         return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
       }
 
-      const parseResult = await validateJsonBody(request, updateA2AAgentBodySchema)
-      if (!parseResult.success) {
-        return NextResponse.json(
-          {
-            error: parseResult.error
-              ? getValidationErrorMessage(parseResult.error)
-              : 'Invalid request body',
-          },
-          { status: 400 }
-        )
-      }
-      const body = parseResult.data
+      const parsed = await parseRequest(updateA2AAgentContract, request, { params })
+      if (!parsed.success) return parsed.response
+      const body = parsed.data.body
 
       let skills = body.skills ?? existingAgent.skills
       if (body.skillTags !== undefined) {
@@ -247,18 +238,9 @@ export const POST = withRouteHandler(
         return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
       }
 
-      const actionResult = await validateJsonBody(request, publishA2AAgentBodySchema)
-      if (!actionResult.success) {
-        return NextResponse.json(
-          {
-            error: actionResult.error
-              ? getValidationErrorMessage(actionResult.error)
-              : 'Invalid action',
-          },
-          { status: 400 }
-        )
-      }
-      const { action } = actionResult.data
+      const parsed = await parseRequest(publishA2AAgentContract, request, { params })
+      if (!parsed.success) return parsed.response
+      const { action } = parsed.data.body
 
       if (action === 'publish') {
         const [wf] = await db

apps/sim/app/api/a2a/agents/route.ts

@@ -13,8 +13,8 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { generateSkillsFromWorkflow } from '@/lib/a2a/agent-card'
 import { A2A_DEFAULT_CAPABILITIES } from '@/lib/a2a/constants'
 import { sanitizeAgentName } from '@/lib/a2a/utils'
-import { createA2AAgentBodySchema, listA2AAgentsQuerySchema } from '@/lib/api/contracts/a2a-agents'
-import { getValidationErrorMessage, validateJsonBody } from '@/lib/api/server'
+import { createA2AAgentContract, listA2AAgentsQuerySchema } from '@/lib/api/contracts/a2a-agents'
+import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { captureServerEvent } from '@/lib/posthog/server'
@@ -104,20 +104,11 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
     }
 
-    const parseResult = await validateJsonBody(request, createA2AAgentBodySchema)
-    if (!parseResult.success) {
-      return NextResponse.json(
-        {
-          error: parseResult.error
-            ? getValidationErrorMessage(parseResult.error)
-            : 'Invalid request body',
-        },
-        { status: 400 }
-      )
-    }
+    const parsed = await parseRequest(createA2AAgentContract, request, {})
+    if (!parsed.success) return parsed.response
 
     const { workspaceId, workflowId, name, description, capabilities, authentication, skillTags } =
-      parseResult.data
+      parsed.data.body
 
     const workspaceAccess = await checkWorkspaceAccess(workspaceId, auth.userId)
     if (!workspaceAccess.exists) {

apps/sim/app/api/credentials/[id]/members/route.ts

@@ -4,8 +4,8 @@ import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
 import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
-import { addCredentialMemberBodySchema } from '@/lib/api/contracts/credentials'
-import { getValidationErrorMessage, validateJsonBody } from '@/lib/api/server'
+import { upsertWorkspaceCredentialMemberContract } from '@/lib/api/contracts/credentials'
+import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
@@ -105,19 +105,10 @@ export const POST = withRouteHandler(async (request: NextRequest, context: Route
       return NextResponse.json({ error: 'Admin access required' }, { status: 403 })
     }
 
-    const parsed = await validateJsonBody(request, addCredentialMemberBodySchema)
-    if (!parsed.success) {
-      return NextResponse.json(
-        {
-          error: parsed.error
-            ? getValidationErrorMessage(parsed.error, 'Invalid request body')
-            : 'Invalid request body',
-        },
-        { status: 400 }
-      )
-    }
+    const parsed = await parseRequest(upsertWorkspaceCredentialMemberContract, request, context)
+    if (!parsed.success) return parsed.response
 
-    const { userId, role } = parsed.data
+    const { userId, role } = parsed.data.body
     const now = new Date()
 
     const [existing] = await db

apps/sim/app/api/credentials/draft/route.ts

@@ -3,9 +3,9 @@ import { credential, credentialMember, pendingCredentialDraft } from '@sim/db/sc
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
 import { and, eq, lt } from 'drizzle-orm'
-import { NextResponse } from 'next/server'
-import { createCredentialDraftBodySchema } from '@/lib/api/contracts/credentials'
-import { getValidationErrorMessage, validateJsonBody } from '@/lib/api/server'
+import { type NextRequest, NextResponse } from 'next/server'
+import { createCredentialDraftContract } from '@/lib/api/contracts/credentials'
+import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
@@ -14,26 +14,17 @@ const logger = createLogger('CredentialDraftAPI')
 
 const DRAFT_TTL_MS = 15 * 60 * 1000
 
-export const POST = withRouteHandler(async (request: Request) => {
+export const POST = withRouteHandler(async (request: NextRequest) => {
   try {
     const session = await getSession()
     if (!session?.user?.id) {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
     }
 
-    const parsed = await validateJsonBody(request, createCredentialDraftBodySchema)
-    if (!parsed.success) {
-      return NextResponse.json(
-        {
-          error: parsed.error
-            ? getValidationErrorMessage(parsed.error, 'Invalid request body')
-            : 'Invalid request body',
-        },
-        { status: 400 }
-      )
-    }
+    const parsed = await parseRequest(createCredentialDraftContract, request, {})
+    if (!parsed.success) return parsed.response
 
-    const { workspaceId, providerId, displayName, description, credentialId } = parsed.data
+    const { workspaceId, providerId, displayName, description, credentialId } = parsed.data.body
     const userId = session.user.id
 
     const workspaceAccess = await checkWorkspaceAccess(workspaceId, userId)

apps/sim/app/api/mothership/chats/read/route.ts

@@ -3,8 +3,8 @@ import { copilotChats } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq, sql } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
-import { markMothershipChatReadBodySchema } from '@/lib/api/contracts/mothership-tasks'
-import { validateJsonBody } from '@/lib/api/server'
+import { markMothershipChatReadContract } from '@/lib/api/contracts/mothership-tasks'
+import { parseRequest } from '@/lib/api/server'
 import {
   authenticateCopilotRequestSessionOnly,
   createInternalServerErrorResponse,
@@ -21,9 +21,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       return createUnauthorizedResponse()
     }
 
-    const validation = await validateJsonBody(request, markMothershipChatReadBodySchema)
-    if (!validation.success) return validation.response
-    const { chatId } = validation.data
+    const parsed = await parseRequest(markMothershipChatReadContract, request, {})
+    if (!parsed.success) return parsed.response
+    const { chatId } = parsed.data.body
 
     await db
       .update(copilotChats)

apps/sim/app/api/telemetry/route.ts

@@ -1,7 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
-import { telemetryEventSchema } from '@/lib/api/contracts/telemetry'
-import { validateJsonBody } from '@/lib/api/server'
+import { telemetryContract } from '@/lib/api/contracts/telemetry'
+import { parseRequest } from '@/lib/api/server'
 import { env } from '@/lib/core/config/env'
 import { isProd } from '@/lib/core/config/feature-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -149,18 +149,10 @@ async function forwardToCollector(data: Record<string, unknown>): Promise<boolea
  */
 export const POST = withRouteHandler(async (req: NextRequest) => {
   try {
-    const validation = await validateJsonBody(req, telemetryEventSchema)
-    if (!validation.success) {
-      if (!validation.error) {
-        return NextResponse.json({ error: 'Invalid JSON in request body' }, { status: 400 })
-      }
-      return NextResponse.json(
-        { error: 'Invalid telemetry data format or contains sensitive information' },
-        { status: 400 }
-      )
-    }
+    const parsed = await parseRequest(telemetryContract, req, {})
+    if (!parsed.success) return parsed.response
 
-    const forwarded = await forwardToCollector(validation.data as Record<string, unknown>)
+    const forwarded = await forwardToCollector(parsed.data.body)
 
     return NextResponse.json({
       success: true,