fix: add schema-level validation for grace parameter (0-7) (JhaSourav07#3075)

* fix: add schema-level validation for grace parameter (0-7)

* fix: handle empty grace string by defaulting to 1

* chore: reorder tests and install vitest dependencies

* fix test and typecheck issues

---------

Co-authored-by: rashi-gupta-08 <gupta08rashi@gmail.com>
Co-authored-by: Aamod Kumar <119789532+Aamod007@users.noreply.github.com>

Author: 3 people

app/api/streak/route.test.ts

@@ -116,6 +116,18 @@ describe('GET /api/streak', () => {
       expect(body.details.fieldErrors.grace[0]).toBe('grace must be an integer between 0 and 7');
     });
 
+    it('returns 400 when grace exceeds max value', async () => {
+      const response = await GET(
+        makeRequest({
+          user: 'octocat',
+          grace: '999',
+        })
+      );
+      expect(response.status).toBe(400);
+      const body = await response.json();
+      expect(body.details.fieldErrors.grace[0]).toBe('grace must be an integer between 0 and 7');
+    });
+
     it('returns 400 when days=0 is provided', async () => {
       const response = await GET(
         makeRequest({
@@ -410,17 +422,6 @@ describe('GET /api/streak', () => {
       expect(fetchGitHubContributions).toHaveBeenCalled();
     });
 
-    it('returns 400 when grace exceeds max value', async () => {
-      const response = await GET(
-        makeRequest({
-          user: 'octocat',
-          grace: '999',
-        })
-      );
-
-      expect(response.status).toBe(400);
-    });
-
     it('embeds the username (uppercased) in the SVG title', async () => {
       const response = await GET(makeRequest({ user: 'octocat' }));
       const body = await response.text();

lib/validations.test.ts

@@ -6,6 +6,10 @@ import {
   validateGitHubUsername,
 } from './validations';
 
+function parse(params: Record<string, string>) {
+  return streakParamsSchema.parse({ user: 'octocat', ...params });
+}
+
 describe('streakParamsSchema — grace fallback behavior', () => {
   it('accepts "0" as a valid grace value', () => {
     expect(parse({ grace: '0' }).grace).toBe(0);
@@ -43,6 +47,10 @@ describe('streakParamsSchema — grace fallback behavior', () => {
   it('defaults to 1 when grace is omitted', () => {
     expect(parse({}).grace).toBe(1);
   });
+
+  it('defaults to 1 when grace is empty string', () => {
+    expect(parse({ grace: '' }).grace).toBe(1);
+  });
 });
 
 describe('validateGitHubUsername', () => {
@@ -479,49 +487,144 @@ describe('streakParamsSchema', () => {
   });
 });
 
-it('should succeed when username contains hyphens', () => {
-  const result = streakParamsSchema.safeParse({
-    user: 'valid-user',
+describe('streakParamsSchema — user hyphen validation', () => {
+  it('should succeed when username contains hyphens', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'valid-user',
+    });
+
+    expect(result.success).toBe(true);
   });
 
-  expect(result.success).toBe(true);
-});
+  it('should succeed when username contains multiple hyphens', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'valid-user-name-123',
+    });
 
-it('should succeed when username contains multiple hyphens', () => {
-  const result = streakParamsSchema.safeParse({
-    user: 'valid-user-name-123',
+    expect(result.success).toBe(true);
   });
 
-  expect(result.success).toBe(true);
-});
+  it('should fail when username ends with hyphen', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'user-',
+    });
 
-it('should fail when username ends with hyphen', () => {
-  const result = streakParamsSchema.safeParse({
-    user: 'user-',
+    expect(result.success).toBe(false);
   });
 
-  expect(result.success).toBe(false);
-});
+  it('should fail when username starts with hyphen', () => {
+    const result = streakParamsSchema.safeParse({
+      user: '-user',
+    });
 
-it('should fail when username starts with hyphen', () => {
-  const result = streakParamsSchema.safeParse({
-    user: '-user',
+    expect(result.success).toBe(false);
   });
 
-  expect(result.success).toBe(false);
+  it('should fail when username contains consecutive hyphens', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'user--name',
+    });
+
+    expect(result.success).toBe(false);
+  });
 });
 
-it('should fail when username contains consecutive hyphens', () => {
-  const result = streakParamsSchema.safeParse({
-    user: 'user--name',
+describe('streakParamsSchema — grace validation', () => {
+  it('accepts grace=0', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'octocat',
+      grace: '0',
+    });
+
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.grace).toBe(0);
+    }
   });
 
-  expect(result.success).toBe(false);
-});
+  it('accepts grace=7', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'octocat',
+      grace: '7',
+    });
 
-function parse(params: Record<string, string>) {
-  return streakParamsSchema.parse({ user: 'octocat', ...params });
-}
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.grace).toBe(7);
+    }
+  });
+
+  it('accepts grace=3', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'octocat',
+      grace: '3',
+    });
+
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.grace).toBe(3);
+    }
+  });
+
+  it('defaults to 1 when grace is omitted', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'octocat',
+    });
+
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.grace).toBe(1);
+    }
+  });
+
+  it('rejects grace=-1', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'octocat',
+      grace: '-1',
+    });
+
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues[0]?.message).toBe('grace must be an integer between 0 and 7');
+    }
+  });
+
+  it('rejects grace=8 (exceeds max)', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'octocat',
+      grace: '8',
+    });
+
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues[0]?.message).toBe('grace must be an integer between 0 and 7');
+    }
+  });
+
+  it('rejects non-numeric grace value', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'octocat',
+      grace: 'abc',
+    });
+
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues[0]?.message).toBe('grace must be an integer between 0 and 7');
+    }
+  });
+
+  it('rejects float grace value', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'octocat',
+      grace: '5.5',
+    });
+
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues[0]?.message).toBe('grace must be an integer between 0 and 7');
+    }
+  });
+});
 
 describe('streakParamsSchema — scale fallback behavior', () => {
   it('accepts "log" as a valid scale value', () => {

lib/validations.ts

@@ -280,14 +280,14 @@ const baseStreakParamsSchema = z.object({
     .optional()
     .refine(
       (val) => {
-        if (!val) return true;
-        const parsed = Number(val);
-        return !isNaN(parsed) && Number.isInteger(parsed) && parsed >= 0 && parsed <= 7;
+        if (val === undefined || val === '') return true;
+        return /^\d+$/.test(val) && Number(val) >= 0 && Number(val) <= 7;
       },
       { message: 'grace must be an integer between 0 and 7' }
     )
-    .transform(toGraceValue)
+    .transform((val) => (val === undefined || val === '' ? 1 : Number(val)))
     .default(1),
+
   mode: z.enum(['commits', 'loc']).catch('commits').default('commits'),
   repo: z.string().optional(),
   org: z

package-lock.json

@@ -52,6 +52,7 @@
   "devDependencies": {
     "@emnapi/core": "^1.10.0",
     "@emnapi/runtime": "^1.10.0",
+    "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",