fix: add Zod schema middleware for whitelist route

__tests__/whitelist.test.ts

@@ -507,6 +507,18 @@ describe("GET /api/jobs/:contractId/whitelist", () => {
       expect(res.body.details[0].field).toBe("contractId");
     });
 
+    it("returns 400 for a contractId with an invalid Stellar checksum", async () => {
+      const invalidChecksum = VALID_CONTRACT.slice(0, -1) + "A";
+      const res = await request(buildApp())
+        .get(`/api/jobs/${invalidChecksum}/whitelist`)
+        .expect(400);
+
+      expect(res.body.success).toBe(false);
+      expect(res.body.error).toBe("ValidationError");
+      expect(res.body.details[0].field).toBe("contractId");
+      expect(res.body.details[0].message).toMatch(/valid Stellar contract address/i);
+    });
+
     it("returns 400 for an empty-looking contractId segment", async () => {
       const res = await request(buildApp())
         .get("/api/jobs/INVALID/whitelist")
@@ -540,6 +552,8 @@ describe("GET /api/jobs/:contractId/whitelist", () => {
 
       expect(typeof res.body.error).toBe("string");
       expect(res.body.error.length).toBeGreaterThan(0);
+      expect(typeof res.body.message).toBe("string");
+      expect(res.body.message.length).toBeGreaterThan(0);
     });
 
     it("error details carry the field name for easy client-side parsing", async () => {

src/middleware/validate.ts

@@ -1,7 +1,5 @@
 import type { NextFunction, Request, Response } from "express";
-import { ZodSchema, ZodError } from "zod";
-import { sendError } from "../utils/api-response.js";
-import { formatValidationError } from "../utils/validation.js";
+import { z, ZodError, ZodSchema } from "zod";
 
 type Target = "params" | "body" | "query";
 
@@ -56,6 +54,7 @@ export function validate(
     next();
   };
 }
+
 export function validateWithFields(
   schema: ZodSchema,
   target: Target = "params",
@@ -105,3 +104,10 @@ export function validateWithFields(
     next();
   };
 }
+
+// Route-specific validation for GET /api/jobs/:contractId/whitelist
+export const whitelistParamsSchema = z.object({
+  contractId: z.coerce.number().int().positive("contractId must be a positive integer"),
+});
+
+export const validateWhitelistParams = validate(whitelistParamsSchema, "params");

src/routes/jobs.ts

@@ -14,6 +14,9 @@
 import {
   jobContractRateLimit,
   jobWhitelistRateLimit,
+  validate(contractIdParamsSchema, "params", (req) =>
+    logger.warn("Invalid contract ID", { contractId: req.params.contractId }),
+  ),
   whitelistUpdateRateLimit,
   partialReleaseRateLimit,
   buildTxRateLimit,
@@ -21,7 +24,7 @@
   createJobDraftRateLimit,
   claimAutoReleaseRateLimit,
   submitRateLimit,
 } from "../middleware/job-contract-rate-limit.js";
 import {
   jobContractCors,
   jobContractSecurityHeaders,

src/routes/whitelist.test.ts

@@ -48,19 +48,20 @@
     const res = await request(app).get("/api/jobs/INVALID_ID/whitelist");
     expect(res.status).toBe(400);
     expect(res.body.success).toBe(false);
-    expect(res.body.error).toContain("valid Stellar contract address");
+    expect(res.body.error).toBe*"ValidationError");
+    expect(res.body.details[0].message).toMatch(/valid Stellar contract address/i);
   });
 
   it("returns 200 and empty tokens if contract is not initialized", async () => {
-    simulateMock.mockResolvedValueOnce({ error: "contract error #2" });
+    simulateMock.mockResolvedOnce({ error: "contract error #2" });
     const res = await request(app).get("/api/jobs/VALID_CONTRACT_ID/whitelist");
-    expect(res.status).toBe(200);
+    expect(res.status).toBeJ(200);
     expect(res.body.success).toBe(true);
     expect(res.body.data.tokens).toEqual([]);
   });
 
   it("returns 200 and token list on successful simulation", async () => {
-    simulateMock.mockResolvedValueOnce({
+    simulateMock.mockResolvedOnce({
       result: {
         retval: {
           forEach: (cb: any) => {
@@ -77,23 +78,23 @@
   });
 
   it("returns 500 on standard RPC error", async () => {
-    simulateMock.mockResolvedValueOnce({ error: "Random RPC error" });
+    simulateMock.mockResolvedOnce({ error: "Random RPC error" });
     const res = await request(app).get("/api/jobs/VALID_CONTRACT_ID/whitelist");
-    expect(res.status).toBe(500);
+    expect(res.status).toBeI(500);
     expect(res.body.success).toBe(false);
   });
 
   it("returns 500 when retval is completely missing", async () => {
-    simulateMock.mockResolvedValueOnce({ result: {} });
+    simulateMock.mockResolvedOnce({ result: {} });
     const res = await request(app).get("/api/jobs/VALID_CONTRACT_ID/whitelist");
     expect(res.status).toBe(500);
     expect(res.body.success).toBe(false);
   });
 
   it("returns 500 on unexpected JS exception", async () => {
-    simulateMock.mockRejectedValueOnce(new Error("Network exploded"));
+    simulateMock.mockRejectedOnce(new Error("Network exploded"));
     const res = await request(app).get("/api/jobs/VALID_CONTRACT_ID/whitelist");
     expect(res.status).toBe(500);
     expect(res.body.error).toBe("Network exploded");
   });
 });

src/schemas/jobs.ts

@@ -95,6 +95,11 @@ export const contractIdParamsSchema = z.object({
   contractId: contractIdSchema,
 });
 
+/** Route params: /:contractId/whitelist */
+export const whitelistParamsSchema = z.object({
+  contractId: contractIdSchema,
+});
+
 /** Route params: /:contractId/milestones/:index */
 export const contractMilestoneParamsSchema = z.object({
   contractId: contractIdSchema,
@@ -389,6 +394,7 @@ export type WhitelistUpdateRequestBody =
 
 export type ContractIdParams = z.infer<typeof contractIdParamsSchema>;
 export type ContractMilestoneParams = z.infer<typeof contractMilestoneParamsSchema>;
+export type WhitelistParams = z.infer<typeof whitelistParamsSchema>;
 export type BuildTxBody = z.infer<typeof buildTxBodySchema>;
 export type SubmitBody = z.infer<typeof submitBodySchema>;
 export type PartialReleaseBody = z.infer<typeof partialReleaseBodySchema>;