Zod for API Routes

app/api/user/change/password/route.ts

@@ -2,20 +2,17 @@ import { NextRequest, NextResponse } from "next/server";
 import prisma from "@/app/prisma";
 import jwt from "jsonwebtoken";
 import bcrypt from "bcryptjs";
+import { z } from "zod/v4"; 
 
-interface Body {
-    token: string;
-    old_password: string;
-    password: string;
-}
+const schema = z.object({
+    token: z.string(),
+    old_password: z.string(),
+    password: z.string().min(8, "Password must be at least 8 characters long").max(32, "Password must be at most 32 characters long").regex(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,32}$/, "Password must contain at least one lowercase letter, one uppercase letter, one digit, and one special character"),
+});
 
 export async function POST(request: NextRequest) {
     try {
-        const body: Body = await request.json();
-
-        if (!body.token || !body.old_password || !body.password) {
-            return NextResponse.json({ error: "Missing required fields" }, { status: 400 });
-        }
+        const body = schema.parse(await request.json());
 
         if(!process.env.JWT_SECRET) {
             return NextResponse.json({ error: "No JWT secret found" }, { status: 500 });
@@ -52,6 +49,9 @@ export async function POST(request: NextRequest) {
 
         return NextResponse.json({ message: "Password updated successfully" }, { status: 200 });
     } catch (error: any) {
+        if(error instanceof z.ZodError) {
+            return NextResponse.json({ error: error.issues[0].message }, { status: 400 });
+        }
         return NextResponse.json({ error: "Internal Server Error" }, { status: 500 });
     }
 }

app/api/user/change/profile/route.ts

@@ -1,21 +1,18 @@
 import { NextRequest, NextResponse } from "next/server";
 import prisma from "@/app/prisma";
 import jwt from "jsonwebtoken";
+import { z } from "zod/v4";
 
-interface Body {
-    token: string;
-    username: string;
-    name: string;
-    email: string;
-}
+const schema = z.object({
+    token: z.string(),
+    username: z.string().min(3, "Username must be at least 3 characters long").max(32, "Username must be at most 32 characters long"),
+    name: z.string().min(3, "Name must be at least 3 characters long").max(32, "Name must be at most 32 characters long"),
+    email: z.string().email("Invalid email address"),
+});
 
 export async function POST(request: NextRequest) {
     try {
-        const body: Body = await request.json();
-
-        if (!body.username || !body.name || !body.email) {
-            return NextResponse.json({ error: "Missing required fields" }, { status: 400 });
-        }
+        const body = schema.parse(await request.json());
 
         if(!process.env.JWT_SECRET) {
             return NextResponse.json({ error: "No JWT secret found" }, { status: 500 });
@@ -46,6 +43,9 @@ export async function POST(request: NextRequest) {
 
         return NextResponse.json({ message: "Profile updated successfully" }, { status: 200 });
     } catch (error: any) {
+        if(error instanceof z.ZodError) {
+            return NextResponse.json({ error: error.issues[0].message }, { status: 400 });
+        }
         return NextResponse.json({ error: "Internal Server Error" }, { status: 500 });
     }
 }