API security

import { z } from "zod";

// Input schema: only these fields may be set by a client. role, tenantId, balance are absent.
const UpdateProfile = z.object({
  displayName: z.string().min(1).max(80),
  timezone: z.string().max(64).optional(),
}).strict(); // unknown keys are rejected, not silently dropped

// Output DTO: only these fields ever leave the service.
const toPublicUser = (u: UserRow) => ({ id: u.id, displayName: u.displayName, timezone: u.timezone });

app.patch("/users/:id", requireAuth, async (req, res) => {
  const input = UpdateProfile.parse(req.body);              // BOPLA: mass assignment blocked
  if (req.params.id !== req.user.id && !req.user.can("users:update:any")) {
    return res.status(404).end();                          // BOLA and BFLA: deny, do not confirm existence
  }
  const user = await users.update(
    { id: req.params.id, tenantId: req.user.tenantId },    // scoped by tenant, always
    input,
  );
  if (!user) return res.status(404).end();
  res.json(toPublicUser(user));                            // BOPLA: no passwordHash, no internal flags
});

# OpenAPI fragment the gateway enforces: unknown fields rejected, bounds explicit.
paths:
  /v2/invoices:
    get:
      security: [{ oauth: ["invoices:read"] }]
      parameters:
        - { name: limit, in: query, schema: { type: integer, minimum: 1, maximum: 200, default: 50 } }
        - { name: cursor, in: query, schema: { type: string, maxLength: 128 } }
components:
  schemas:
    InvoiceCreate:
      type: object
      additionalProperties: false
      required: [customerId, lines]
      properties:
        customerId: { type: string, format: uuid }
        lines:
          type: array
          maxItems: 100
          items: { $ref: "#/components/schemas/InvoiceLine" }