fix(core): apply localeCode validation to taxonomy/menu locale filter (emdash-cms#1551)

The shared `localeFilterQuery` (used by taxonomy and menu endpoints) still
used a plain `z.string()` while `contentListQuery` and the search schemas
adopted the stricter, casing-preserving `localeCode`. Reusing `localeCode`
here tightens BCP-47 validation and keeps locale handling consistent across
the API: a malformed `?locale=` value is now rejected instead of silently
matching zero rows. Addresses non-blocking review feedback on emdash-cms#1572.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: marcusbellamyshaw-cell

.changeset/localecode-preserve-casing.md

@@ -2,4 +2,4 @@
 "emdash": patch
 ---
 
-Fixes the content and search APIs returning zero results when filtering by a locale with an uppercase region or script subtag (e.g. `?locale=zh-TW`, `pt-BR`, `zh-Hant`). The `localeCode` validator lowercased the value, but config locales, the stored `locale` column, and the public query path all preserve the original casing, so the filter matched nothing. Validation stays case-insensitive; the value is now preserved verbatim. Closes #1551.
+Fixes the content and search APIs returning zero results when filtering by a locale with an uppercase region or script subtag (e.g. `?locale=zh-TW`, `pt-BR`, `zh-Hant`). The `localeCode` validator lowercased the value, but config locales, the stored `locale` column, and the public query path all preserve the original casing, so the filter matched nothing. Validation stays case-insensitive; the value is now preserved verbatim. The taxonomy and menu endpoints' shared `?locale=` filter now applies the same BCP-47 validation, so a malformed locale is rejected with a clear error instead of silently matching nothing. Closes #1551.

packages/core/src/api/schemas/common.ts

@@ -64,7 +64,7 @@ export const localeCode = z.string().regex(/^[a-z]{2,3}(-[a-z0-9]{2,8})*$/i, "In
 /** Shared `?locale=xx` query shape for endpoints that filter by locale. */
 export const localeFilterQuery = z
 	.object({
-		locale: z.string().min(1).optional(),
+		locale: localeCode.optional(),
 	})
 	.meta({ id: "LocaleFilterQuery" });
 

packages/core/tests/unit/api/schemas.test.ts

@@ -8,6 +8,7 @@ import {
 	updateFieldBody,
 	httpUrl,
 	localeCode,
+	localeFilterQuery,
 	mediaUploadUrlBody,
 	DEFAULT_MAX_UPLOAD_SIZE,
 } from "../../../src/api/schemas/index.js";
@@ -157,6 +158,12 @@ describe("localeCode validator (#1551)", () => {
 		const result = contentCreateBody.parse({ data: { title: "Hi" }, locale: "pt-BR" });
 		expect(result.locale).toBe("pt-BR");
 	});
+
+	it("localeFilterQuery keeps the ?locale= casing and rejects malformed values", () => {
+		expect(localeFilterQuery.parse({ locale: "zh-TW" }).locale).toBe("zh-TW");
+		expect(localeFilterQuery.parse({}).locale).toBeUndefined();
+		expect(() => localeFilterQuery.parse({ locale: "_invalid_" })).toThrow();
+	});
 });
 
 describe("httpUrl validator", () => {