Replace Ad-Hoc Validation in All API Routes with Zod

Description

Every API route currently validates request bodies with manual checks: field presence tests, typeof guards, and one-off regex patterns. This is inconsistent, error-prone, and bypasses the shared schema limits. This task replaces all of that with schema.safeParse(body) calls using the schemas defined in Task #341.

Associated Epic: #340

Subtasks

next/app/api/user/[id]/route.ts — replace manual PUT body checks with user.schema
next/app/api/event/route.ts and event/[id]/route.ts — replace with event.schema
next/app/api/quotes/route.ts — replace with quote.schema
next/app/api/golinks/route.ts — replace with golink.schema (note: GoLink name regex already exists, consolidate into schema)
next/app/api/mentor/route.ts — replace with mentor.schema
next/app/api/project/route.ts and project/[id]/route.ts — replace with project.schema
next/app/api/sponsor/route.ts — replace with sponsor.schema
next/app/api/alumni/route.ts and alumni-requests/route.ts — replace with alumni.schema
next/app/api/announcement/route.ts — replace with announcement.schema
next/app/api/purchasing/route.ts — replace with purchasing.schema
All routes: use the apiError helpers from Task #342 for parse failures

Acceptance Criteria

No route uses manual typeof or "field" in body checks for validated fields
A POST/PUT with a field that exceeds the max length returns 400 with a descriptive error
A POST/PUT missing a required field returns 400
A POST/PUT with an invalid URL format (e.g. javascript: scheme) returns 400

# Replace Ad-Hoc Validation in All API Routes with Zod ## Description Every API route currently validates request bodies with manual checks: field presence tests, typeof guards, and one-off regex patterns. This is inconsistent, error-prone, and bypasses the shared schema limits. This task replaces all of that with schema.safeParse(body) calls using the schemas defined in Task #341. Associated Epic: #340 ## Subtasks - [ ] next/app/api/user/[id]/route.ts — replace manual PUT body checks with user.schema - [ ] next/app/api/event/route.ts and event/[id]/route.ts — replace with event.schema - [ ] next/app/api/quotes/route.ts — replace with quote.schema - [ ] next/app/api/golinks/route.ts — replace with golink.schema (note: GoLink name regex already exists, consolidate into schema) - [ ] next/app/api/mentor/route.ts — replace with mentor.schema - [ ] next/app/api/project/route.ts and project/[id]/route.ts — replace with project.schema - [ ] next/app/api/sponsor/route.ts — replace with sponsor.schema - [ ] next/app/api/alumni/route.ts and alumni-requests/route.ts — replace with alumni.schema - [ ] next/app/api/announcement/route.ts — replace with announcement.schema - [ ] next/app/api/purchasing/route.ts — replace with purchasing.schema - [ ] All routes: use the apiError helpers from Task #342 for parse failures ## Acceptance Criteria - [ ] No route uses manual typeof or "field" in body checks for validated fields - [ ] A POST/PUT with a field that exceeds the max length returns 400 with a descriptive error - [ ] A POST/PUT missing a required field returns 400 - [ ] A POST/PUT with an invalid URL format (e.g. javascript: scheme) returns 400

Rows
Columns

Task: Replace Ad-Hoc Validation in All API Routes with Zod #342

Replace Ad-Hoc Validation in All API Routes with Zod

Description

Subtasks

Acceptance Criteria