fix: validate mailing list script input with shared zod schema (CM-1318)

Signed-off-by: Uroš Marolt <uros@marolt.me>

Author: themarolt

backend/src/api/integration/helpers/mailingListAuthenticate.ts

@@ -29,7 +29,7 @@ const isSafeSourceUrl = (sourceUrl: string): boolean => {
   }
 }
 
-const bodySchema = z.object({
+export const bodySchema = z.object({
   lists: z
     .array(
       z.object({

backend/src/bin/scripts/create-mailing-list-integration.ts

@@ -7,9 +7,11 @@ import * as fs from 'fs'
 
 import { DEFAULT_TENANT_ID, generateUUIDv1 } from '@crowd/common'
 
+import { bodySchema } from '@/api/integration/helpers/mailingListAuthenticate'
 import SegmentRepository from '@/database/repositories/segmentRepository'
 import SequelizeRepository from '@/database/repositories/sequelizeRepository'
 import IntegrationService from '@/services/integrationService'
+import { validateOrThrow } from '@/utils/validation'
 
 const options = [
   {
@@ -67,14 +69,20 @@ if (parameters.help || !parameters.file) {
       process.exit(1)
     }
 
-    let lists
+    let parsed: unknown
     try {
-      lists = JSON.parse(fileContents)
+      parsed = JSON.parse(fileContents)
     } catch (err) {
       console.error(`File at ${parameters.file} is not valid JSON: ${(err as Error).message}`)
       process.exit(1)
     }
 
+    // Same validation as the connect API endpoint (mailingListAuthenticate.ts),
+    // so a malformed file (non-array, missing fields, duplicate/non-https
+    // sourceUrl) fails fast here instead of reaching IntegrationService with
+    // whatever shape the file happened to contain.
+    const { lists } = validateOrThrow(bodySchema, { lists: parsed })
+
     const repoOptions = await SequelizeRepository.getDefaultIRepositoryOptions()
     repoOptions.currentTenant = { id: DEFAULT_TENANT_ID }
     ;(repoOptions as unknown as { requestId: string }).requestId = generateUUIDv1()