test(api validation): Veried query validation boundaries for grace params (JhaSourav07#2184)

## Description
- Added schema-level `refine` to `grace` field in `lib/validations.ts` —
rejects values outside `[0, 7]` (integers only) with error message
`'grace must be an integer between 0 and 7'` instead of silently
clamping
- Added test in `app/api/streak/route.test.ts`: `grace=-1` returns 400
with the correct field error
- Updated existing `grace=999` test to expect 400 (was 200 under old
clamping behavior)


Fixes JhaSourav07#1454 

## Pillar

- [ ] 🎨 Pillar 1 — New Theme Design
- [ ] 📐 Pillar 2 — Geometric SVG Improvement
- [ ] 🕐 Pillar 3 — Timezone Logic Optimization
- [x] 🛠️ Other (Bug fix, refactoring, docs)

## Checklist before requesting a review:

- [x] I have read the `CONTRIBUTING.md` file.
- [x] I have tested these changes locally
(`localhost:3000/api/streak?user=YOUR_USERNAME`).
- [x] I have run `npm run format` and `npm run lint` locally and
resolved all errors (CI will fail otherwise).
- [x] My commits follow the Conventional Commits format (e.g.,
`feat(themes): ...`, `fix(calculate): ...`).
- [x] I have updated `README.md` if I added a new theme or URL
parameter.
- [x] I have started the repo.
- [x] I have made sure that i have only one commit to merge in this PR.
- [x] The SVG output matches the CommitPulse "premium quality" aesthetic
standard (no raw elements, smooth animations, correct fonts).
- [ ] (Recommended) I joined the CommitPulse Discord community for
contributor discussions, mentorship, and faster PR support.

Author: JhaSourav07

app/api/streak/route.test.ts

@@ -103,6 +103,18 @@ describe('GET /api/streak', () => {
   });
 
   describe('parameter validation', () => {
+    it('returns 400 when grace=-1 is provided', async () => {
+      const response = await GET(
+        makeRequest({
+          user: 'octocat',
+          grace: '-1',
+        })
+      );
+      expect(response.status).toBe(400);
+      const body = await response.json();
+      expect(body.details.fieldErrors.grace[0]).toBe('grace must be an integer between 0 and 7');
+    });
+
     it('returns 400 Bad Request when ?layout= is set to an unsupported format', async () => {
       const response = await GET(
         makeRequest({
@@ -305,18 +317,15 @@ describe('GET /api/streak', () => {
       expect(fetchGitHubContributions).toHaveBeenCalled();
     });
 
-    it('returns valid SVG when grace exceeds max value', async () => {
+    it('returns 400 when grace exceeds max value', async () => {
       const response = await GET(
         makeRequest({
           user: 'octocat',
           grace: '999',
         })
       );
 
-      expect(response.status).toBe(200);
-
-      const body = await response.text();
-      expect(body).toContain('<svg');
+      expect(response.status).toBe(400);
     });
 
     it('embeds the username (uppercased) in the SVG title', async () => {

lib/validations.test.ts

@@ -10,28 +10,29 @@ describe('streakParamsSchema — grace fallback behavior', () => {
     expect(parse({ grace: '7' }).grace).toBe(7);
   });
 
-  it('clamps "8" to 7', () => {
-    expect(parse({ grace: '8' }).grace).toBe(7);
+  it('rejects "8" as out-of-range', () => {
+    const result = streakParamsSchema.safeParse({ user: 'octocat', grace: '8' });
+    expect(result.success).toBe(false);
   });
 
-  it('clamps "-1" to 0', () => {
-    expect(parse({ grace: '-1' }).grace).toBe(0);
+  it('rejects "-1" and returns correct error message', () => {
+    const result = streakParamsSchema.safeParse({ user: 'octocat', grace: '-1' });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.flatten().fieldErrors.grace?.[0]).toBe(
+        'grace must be an integer between 0 and 7'
+      );
+    }
   });
 
-  it('falls back or clamps a negative non-integer grace input safely', () => {
-    const result = streakParamsSchema.safeParse({
-      user: 'octocat',
-      grace: '-1.5',
-    });
-
-    expect(result.success).toBe(true);
-    if (result.success) {
-      expect(result.data.grace).toBe(0);
-    }
+  it('rejects a negative non-integer grace input', () => {
+    const result = streakParamsSchema.safeParse({ user: 'octocat', grace: '-1.5' });
+    expect(result.success).toBe(false);
   });
 
-  it('falls back to 1 for non-numeric grace value', () => {
-    expect(parse({ grace: 'abc' }).grace).toBe(1);
+  it('rejects non-numeric grace value', () => {
+    const result = streakParamsSchema.safeParse({ user: 'octocat', grace: 'abc' });
+    expect(result.success).toBe(false);
   });
 
   it('defaults to 1 when grace is omitted', () => {

lib/validations.ts

@@ -223,8 +223,18 @@ const baseStreakParamsSchema = z.object({
   delta_format: z.enum(['percent', 'absolute', 'both']).catch('percent').default('percent'),
   width: dimensionParam('width', 100, 1200),
   height: dimensionParam('height', 80, 800),
-  grace: z.string().optional().transform(toGraceValue).default(1),
-  opacity: z.string().optional().transform(toOpacityValue).default(1.0),
+  grace: z
+    .string()
+    .optional()
+    .refine(
+      (val) => {
+        if (val === undefined) return true;
+        const parsed = Number(val);
+        return !isNaN(parsed) && Number.isInteger(parsed) && parsed >= 0 && parsed <= 7;
+      },
+      { message: 'grace must be an integer between 0 and 7' }
+    )
+    .transform((val) => (val === undefined ? 1 : Number(val))),
   mode: z.enum(['commits', 'loc']).catch('commits').default('commits'),
   repo: z.string().optional(),
   org: z
@@ -271,6 +281,7 @@ const baseStreakParamsSchema = z.object({
     .transform((val) => val === 'true' || val === '1'),
   // Glow effect — on by default. Accepts 'true'/'1' (true) or 'false' (false).
   glow: z.string().optional().transform(toBooleanFlag).default(true),
+  opacity: z.string().optional().transform(toOpacityValue),
   entrance: z.enum(['rise', 'fade', 'slide', 'none']).catch('rise').default('rise'),
 
   // Output format: 'svg' (default) or 'json' for programmatic access.