fix(api): add Zod validation and username sanitization to /api/compare

Replace manual null-check validation with compareParamsSchema (Zod v4)
that validates GitHub username format via GITHUB_USERNAME_REGEX, enforces
max length of 39 chars, and includes self-comparison check as a schema
refinement. Adds 11 tests covering validation, error handling, and success.

Closes JhaSourav07#2068

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

app/api/compare/route.test.ts

@@ -0,0 +1,93 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { GET } from './route';
+
+vi.mock('@/lib/github', () => ({
+  getFullDashboardData: vi.fn(),
+}));
+
+import { getFullDashboardData } from '@/lib/github';
+
+const makeRequest = (search: string) => new Request(`http://localhost:3000/api/compare?${search}`);
+
+describe('GET /api/compare', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(getFullDashboardData).mockResolvedValue({
+      calendar: { totalContributions: 50, weeks: [] },
+    } as never);
+  });
+
+  // ── Validation ────────────────────────────────────────────────────────────
+
+  it('returns 400 when user1 is missing', async () => {
+    const res = await GET(makeRequest('user2=octocat'));
+    expect(res.status).toBe(400);
+  });
+
+  it('returns 400 when user2 is missing', async () => {
+    const res = await GET(makeRequest('user1=octocat'));
+    expect(res.status).toBe(400);
+  });
+
+  it('returns 400 when both users are missing', async () => {
+    const res = await GET(makeRequest(''));
+    expect(res.status).toBe(400);
+  });
+
+  it('returns 400 for invalid GitHub username format for user1', async () => {
+    const res = await GET(makeRequest('user1=-invalid&user2=octocat'));
+    expect(res.status).toBe(400);
+    const data = await res.json();
+    expect(data.details.fieldErrors.user1).toBeDefined();
+  });
+
+  it('returns 400 for invalid GitHub username format for user2', async () => {
+    const res = await GET(makeRequest('user1=octocat&user2=-invalid'));
+    expect(res.status).toBe(400);
+    const data = await res.json();
+    expect(data.details.fieldErrors.user2).toBeDefined();
+  });
+
+  it('returns 400 for username exceeding 39 characters', async () => {
+    const res = await GET(makeRequest(`user1=${'a'.repeat(40)}&user2=octocat`));
+    expect(res.status).toBe(400);
+  });
+
+  it('returns 400 when comparing a user with themselves', async () => {
+    const res = await GET(makeRequest('user1=octocat&user2=octocat'));
+    expect(res.status).toBe(400);
+    const data = await res.json();
+    expect(data.details.fieldErrors.user2).toContain('Cannot compare a user with themselves.');
+  });
+
+  it('returns 400 for self-comparison regardless of case', async () => {
+    const res = await GET(makeRequest('user1=OctoCat&user2=octocat'));
+    expect(res.status).toBe(400);
+  });
+
+  // ── Success ──────────────────────────────────────────────────────────────
+
+  it('returns 200 with comparison data for valid users', async () => {
+    const res = await GET(makeRequest('user1=alice&user2=bob'));
+    expect(res.status).toBe(200);
+    const data = await res.json();
+    expect(data.user1).toBeDefined();
+    expect(data.user2).toBeDefined();
+  });
+
+  // ── Error handling ────────────────────────────────────────────────────────
+
+  it('returns 404 when user1 is not found on GitHub', async () => {
+    vi.mocked(getFullDashboardData).mockRejectedValueOnce(new Error('Not found'));
+    const res = await GET(makeRequest('user1=ghost123&user2=octocat'));
+    expect(res.status).toBe(404);
+  });
+
+  it('returns 404 when user2 is not found on GitHub', async () => {
+    vi.mocked(getFullDashboardData)
+      .mockResolvedValueOnce({ calendar: { totalContributions: 0, weeks: [] } } as never)
+      .mockRejectedValueOnce(new Error('Not found'));
+    const res = await GET(makeRequest('user1=octocat&user2=ghost123'));
+    expect(res.status).toBe(404);
+  });
+});

app/api/compare/route.ts

@@ -1,23 +1,23 @@
 import { NextResponse } from 'next/server';
 import { getFullDashboardData } from '@/lib/github';
+import { compareParamsSchema } from '@/lib/validations';
 
 export const revalidate = 3600;
 
 export async function GET(request: Request) {
   const { searchParams } = new URL(request.url);
-  const user1 = searchParams.get('user1');
-  const user2 = searchParams.get('user2');
 
-  if (!user1 || !user2) {
+  const parseResult = compareParamsSchema.safeParse(Object.fromEntries(searchParams.entries()));
+
+  if (!parseResult.success) {
+    const fieldErrors = parseResult.error.flatten();
     return NextResponse.json(
-      { error: 'Both user1 and user2 query parameters are required.' },
+      { error: 'Invalid parameters', details: fieldErrors },
       { status: 400 }
     );
   }
 
-  if (user1.toLowerCase() === user2.toLowerCase()) {
-    return NextResponse.json({ error: 'Cannot compare a user with themselves.' }, { status: 400 });
-  }
+  const { user1, user2 } = parseResult.data;
 
   try {
     const [result1, result2] = await Promise.allSettled([

lib/validations.ts

@@ -419,8 +419,29 @@ export const wrappedParamsSchema = z.object({
   height: dimensionParam('height', 80, 800),
 });
 
+export const compareParamsSchema = z
+  .object({
+    user1: z
+      .string({ error: 'Missing user1 parameter' })
+      .trim()
+      .min(1, { message: 'user1 is required' })
+      .max(39, { message: 'GitHub username cannot exceed 39 characters' })
+      .regex(GITHUB_USERNAME_REGEX, { message: 'Invalid GitHub username for user1' }),
+    user2: z
+      .string({ error: 'Missing user2 parameter' })
+      .trim()
+      .min(1, { message: 'user2 is required' })
+      .max(39, { message: 'GitHub username cannot exceed 39 characters' })
+      .regex(GITHUB_USERNAME_REGEX, { message: 'Invalid GitHub username for user2' }),
+  })
+  .refine((data) => data.user1.toLowerCase() !== data.user2.toLowerCase(), {
+    message: 'Cannot compare a user with themselves.',
+    path: ['user2'],
+  });
+
 export type StreakParams = z.infer<typeof streakParamsSchema>;
 export type GithubParams = z.infer<typeof githubParamsSchema>;
 export type OgParams = z.infer<typeof ogParamsSchema>;
 export type StatsParams = z.infer<typeof statsParamsSchema>;
 export type WrappedParams = z.infer<typeof wrappedParamsSchema>;
+export type CompareParams = z.infer<typeof compareParamsSchema>;