feat: add validation before creating session

server/src/api/controllers/sessionController.js

@@ -1,3 +1,4 @@
+import { matchedData } from 'express-validator'
 import { Session } from '@linux-odyssey/models'
 import {
   createNewSession,
@@ -40,7 +41,7 @@ export async function getSessionList(req, res) {
 }
 
 export async function createSession(req, res) {
-  const { quest_id } = req.body
+  const { quest_id } = matchedData(req)
   try {
     const session = await createNewSession(req.user, quest_id)
     res.status(201).json(sessionDetail(session))
@@ -87,7 +88,7 @@ export async function deleteSessionById(req, res) {
 }
 
 export async function getOrCreateSession(req, res) {
-  const { quest_id } = req.body
+  const { quest_id } = matchedData(req)
   try {
     const session = await getOrCreateActiveSession(req.user, quest_id)
     res.json(sessionDetail(session))

server/src/api/routes/sessions.js

@@ -1,12 +1,25 @@
 import { Router } from 'express'
 import * as sessionController from '../controllers/sessionController.js'
 import { sessionRateLimit } from '../../middleware/rateLimiter.js'
+import {
+  createSessionValidator,
+  activeSessionValidator,
+} from '../validators/sessionValidator.js'
 
 const router = Router()
 
 router.get('/', sessionController.getSessionList)
-router.post('/', sessionRateLimit, sessionController.createSession)
+router.post(
-router.post('/active', sessionController.getOrCreateSession)
+  '/',
+  createSessionValidator,
+  sessionRateLimit,
+  sessionController.createSession
+)
+router.post(
+  '/active',
+  activeSessionValidator,
+  sessionController.getOrCreateSession
+)
 router.get('/:id', sessionController.getSessionById)
 router.delete('/:id', sessionController.deleteSessionById)
 

server/src/api/validators/sessionValidator.js

@@ -0,0 +1,8 @@
+import { check } from 'express-validator'
+import { noError } from '../../middleware/validator.js'
+
+const checkQuestId = () =>
+  check('quest_id').notEmpty().isString().isLowercase().isLength({ max: 64 })
+
+export const createSessionValidator = [checkQuestId(), noError]
+export const activeSessionValidator = [checkQuestId(), noError]