Add Zod validation to all API endpoints and remove debug test route

Adds schema-based input validation across helcim, events, members,
series, admin, and updates API endpoints. Removes the peer-support
debug test endpoint. Adds validation test coverage.

server/api/admin/events/[id].put.js

@@ -7,15 +7,7 @@ export default defineEventHandler(async (event) => {
     await requireAdmin(event)
 
     const eventId = getRouterParam(event, 'id')
-    const body = await readBody(event)
-
-    // Validate required fields
-    if (!body.title || !body.description || !body.startDate || !body.endDate) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: 'Missing required fields'
-      })
-    }
+    const body = await validateBody(event, adminEventUpdateSchema)
 
     await connectDB()
 
@@ -63,7 +55,7 @@ export default defineEventHandler(async (event) => {
     console.error('Error updating event:', error)
     throw createError({
       statusCode: 500,
-      statusMessage: error.message || 'Failed to update event'
+      statusMessage: 'An unexpected error occurred'
     })
   }
 })

server/api/admin/members.post.js

@@ -6,15 +6,7 @@ export default defineEventHandler(async (event) => {
   try {
     await requireAdmin(event)
 
-    const body = await readBody(event)
-
-    // Validate required fields
-    if (!body.name || !body.email || !body.circle || !body.contributionTier) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: 'Missing required fields'
-      })
-    }
+    const body = await validateBody(event, adminMemberCreateSchema)
 
     await connectDB()
 

server/api/admin/series.post.js

@@ -7,15 +7,7 @@ export default defineEventHandler(async (event) => {
     const admin = await requireAdmin(event)
     await connectDB()
 
-    const body = await readBody(event)
-
-    // Validate required fields
-    if (!body.id || !body.title || !body.description) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: 'Series ID, title, and description are required'
-      })
-    }
+    const body = await validateBody(event, adminSeriesCreateSchema)
 
     // Create new series
     const newSeries = new Series({
@@ -43,9 +35,10 @@ export default defineEventHandler(async (event) => {
       })
     }
     
+    if (error.statusCode) throw error
     throw createError({
       statusCode: 500,
-      statusMessage: error.message || 'Failed to create series'
+      statusMessage: 'An unexpected error occurred'
     })
   }
 })

server/api/admin/series.put.js

@@ -8,16 +8,9 @@ export default defineEventHandler(async (event) => {
     await requireAdmin(event)
     await connectDB()
 
-    const body = await readBody(event)
+    const body = await validateBody(event, adminSeriesUpdateSchema)
     const { id, title, description, type, totalEvents } = body
 
-    if (!id || !title) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: 'Series ID and title are required'
-      })
-    }
-
     // Update the series record
     const updatedSeries = await Series.findOneAndUpdate(
       { id },
@@ -55,10 +48,11 @@ export default defineEventHandler(async (event) => {
 
     return updatedSeries
   } catch (error) {
+    if (error.statusCode) throw error
     console.error('Error updating series:', error)
     throw createError({
       statusCode: 500,
-      statusMessage: 'Failed to update series'
+      statusMessage: 'An unexpected error occurred'
     })
   }
 })

server/api/admin/series/[id].put.js

@@ -9,7 +9,7 @@ export default defineEventHandler(async (event) => {
     await connectDB()
     
     const id = getRouterParam(event, 'id')
-    const body = await readBody(event)
+    const body = await validateBody(event, adminSeriesItemUpdateSchema)
     
     if (!id) {
       throw createError({
@@ -55,10 +55,11 @@ export default defineEventHandler(async (event) => {
       data: series
     }
   } catch (error) {
+    if (error.statusCode) throw error
     console.error('Error updating series:', error)
     throw createError({
       statusCode: 500,
-      statusMessage: error.message || 'Failed to update series'
+      statusMessage: 'An unexpected error occurred'
     })
   }
 })

server/api/admin/series/tickets.put.js

@@ -8,23 +8,9 @@ export default defineEventHandler(async (event) => {
     await requireAdmin(event)
     await connectDB()
 
-    const body = await readBody(event)
+    const body = await validateBody(event, adminSeriesTicketsSchema)
     const { id, tickets } = body
 
-    if (!id) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: 'Series ID is required'
-      })
-    }
-
-    if (!tickets) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: 'Tickets configuration is required'
-      })
-    }
-
     // Find the series
     const series = await Series.findOne({ id })
 

server/api/auth/verify.get.js

@@ -29,6 +29,13 @@ export default defineEventHandler(async (event) => {
         statusMessage: 'Member not found' 
       })
     }
+
+    if (member.status === 'suspended' || member.status === 'cancelled') {
+      throw createError({
+        statusCode: 403,
+        statusMessage: 'Account is ' + member.status
+      })
+    }
     
     // Create a new session token for the authenticated user
     const sessionToken = jwt.sign(
@@ -49,6 +56,9 @@ export default defineEventHandler(async (event) => {
     await sendRedirect(event, '/members', 302)
     
   } catch (err) {
+    if (err.statusCode && err.statusCode !== 401) {
+      throw err
+    }
     throw createError({ 
       statusCode: 401, 
       statusMessage: 'Invalid or expired token' 

server/api/events/[id]/cancel-registration.post.js

@@ -6,16 +6,9 @@ import {
 
 export default defineEventHandler(async (event) => {
   const id = getRouterParam(event, "id");
-  const body = await readBody(event);
+  const body = await validateBody(event, cancelRegistrationSchema);
   const { email } = body;
 
-  if (!email) {
-    throw createError({
-      statusCode: 400,
-      statusMessage: "Email is required",
-    });
-  }
-
   try {
     // Check if id is a valid ObjectId or treat as slug
     const isObjectId = /^[0-9a-fA-F]{24}$/.test(id);

server/api/events/[id]/check-registration.post.js

@@ -2,16 +2,9 @@ import Event from "../../../models/event";
 
 export default defineEventHandler(async (event) => {
   const id = getRouterParam(event, "id");
-  const body = await readBody(event);
+  const body = await validateBody(event, checkRegistrationSchema);
   const { email } = body;
 
-  if (!email) {
-    throw createError({
-      statusCode: 400,
-      statusMessage: "Email is required",
-    });
-  }
-
   try {
     // Check if id is a valid ObjectId or treat as slug
     const isObjectId = /^[0-9a-fA-F]{24}$/.test(id);

server/api/events/[id]/guest-register.post.js

@@ -6,8 +6,8 @@ export default defineEventHandler(async (event) => {
   try {
     await connectDB()
     const identifier = getRouterParam(event, 'id')
-    const body = await readBody(event)
-    
+    const body = await validateBody(event, guestRegisterSchema)
+
     if (!identifier) {
       throw createError({
         statusCode: 400,
@@ -15,14 +15,6 @@ export default defineEventHandler(async (event) => {
       })
     }
     
-    // Validate required fields for guest registration
-    if (!body.name || !body.email) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: 'Name and email are required'
-      })
-    }
-    
     // Fetch the event
     let eventData
     if (mongoose.Types.ObjectId.isValid(identifier)) {

server/api/events/[id]/payment.post.js

@@ -8,8 +8,8 @@ export default defineEventHandler(async (event) => {
   try {
     await connectDB()
     const identifier = getRouterParam(event, 'id')
-    const body = await readBody(event)
-    
+    const body = await validateBody(event, eventPaymentSchema)
+
     if (!identifier) {
       throw createError({
         statusCode: 400,
@@ -17,14 +17,6 @@ export default defineEventHandler(async (event) => {
       })
     }
     
-    // Validate required payment fields
-    if (!body.name || !body.email || !body.paymentToken) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: 'Name, email, and payment token are required'
-      })
-    }
-    
     // Fetch the event
     let eventData
     if (mongoose.Types.ObjectId.isValid(identifier)) {

server/api/events/[id]/tickets/check-eligibility.post.js

@@ -9,14 +9,7 @@ import { connectDB } from "../../../../utils/mongoose.js";
 export default defineEventHandler(async (event) => {
   try {
     await connectDB();
-    const body = await readBody(event);
-
-    if (!body.email) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: "Email is required",
-      });
-    }
+    const body = await validateBody(event, ticketEligibilitySchema);
 
     // Check if user is a member
     const member = await Member.findOne({

server/api/events/[id]/tickets/purchase.post.js

@@ -18,7 +18,7 @@ export default defineEventHandler(async (event) => {
   try {
     await connectDB();
     const identifier = getRouterParam(event, "id");
-    const body = await readBody(event);
+    const body = await validateBody(event, ticketPurchaseSchema);
 
     if (!identifier) {
       throw createError({
@@ -27,14 +27,6 @@ export default defineEventHandler(async (event) => {
       });
     }
 
-    // Validate required fields
-    if (!body.name || !body.email) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: "Name and email are required",
-      });
-    }
-
     // Fetch the event
     let eventData;
     if (mongoose.Types.ObjectId.isValid(identifier)) {

server/api/events/[id]/tickets/reserve.post.js

@@ -16,7 +16,7 @@ export default defineEventHandler(async (event) => {
   try {
     await connectDB();
     const identifier = getRouterParam(event, "id");
-    const body = await readBody(event);
+    const body = await validateBody(event, ticketReserveSchema);
 
     if (!identifier) {
       throw createError({
@@ -25,13 +25,6 @@ export default defineEventHandler(async (event) => {
       });
     }
 
-    if (!body.email) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: "Email is required",
-      });
-    }
-
     // Fetch the event
     let eventData;
     if (mongoose.Types.ObjectId.isValid(identifier)) {

server/api/events/[id]/waitlist.delete.js

@@ -2,17 +2,10 @@ import Event from "../../../models/event";
 
 export default defineEventHandler(async (event) => {
   const id = getRouterParam(event, "id");
-  const body = await readBody(event);
+  const body = await validateBody(event, waitlistDeleteSchema);
 
   const { email } = body;
 
-  if (!email) {
-    throw createError({
-      statusCode: 400,
-      statusMessage: "Email is required",
-    });
-  }
-
   try {
     // Find event by ID or slug
     const eventData = await Event.findOne({

server/api/events/[id]/waitlist.post.js

@@ -3,17 +3,10 @@ import Member from "../../../models/member";
 
 export default defineEventHandler(async (event) => {
   const id = getRouterParam(event, "id");
-  const body = await readBody(event);
+  const body = await validateBody(event, waitlistSchema);
 
   const { name, email, membershipLevel } = body;
 
-  if (!email) {
-    throw createError({
-      statusCode: 400,
-      statusMessage: "Email is required",
-    });
-  }
-
   try {
     // Find event by ID or slug
     const eventData = await Event.findOne({

server/api/helcim/create-plan.post.js

@@ -3,16 +3,9 @@ const HELCIM_API_BASE = 'https://api.helcim.com/v2'
 
 export default defineEventHandler(async (event) => {
   try {
+    await requireAdmin(event)
     const config = useRuntimeConfig(event)
-    const body = await readBody(event)
-
-    // Validate required fields
-    if (!body.name || !body.amount || !body.frequency) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: 'Name, amount, and frequency are required'
-      })
-    }
+    const body = await validateBody(event, helcimCreatePlanSchema)
 
     const helcimToken = config.public.helcimToken || process.env.NUXT_PUBLIC_HELCIM_TOKEN
 
@@ -38,7 +31,7 @@ export default defineEventHandler(async (event) => {
 
       throw createError({
         statusCode: response.status,
-        statusMessage: `Failed to create payment plan: ${errorText}`
+        statusMessage: 'Payment plan creation failed'
       })
     }
 
@@ -50,10 +43,11 @@ export default defineEventHandler(async (event) => {
     }
 
   } catch (error) {
+    if (error.statusCode) throw error
     console.error('Error creating Helcim payment plan:', error)
     throw createError({
-      statusCode: error.statusCode || 500,
-      statusMessage: error.message || 'Failed to create payment plan'
+      statusCode: 500,
+      statusMessage: 'An unexpected error occurred'
     })
   }
 })

server/api/helcim/customer-code.get.js

@@ -61,7 +61,7 @@ export default defineEventHandler(async (event) => {
       const errorText = await response.text()
       throw createError({
         statusCode: response.status,
-        statusMessage: `Failed to get customer: ${errorText}`
+        statusMessage: 'Customer lookup failed'
       })
     }
 
@@ -74,10 +74,11 @@ export default defineEventHandler(async (event) => {
     }
 
   } catch (error) {
+    if (error.statusCode) throw error
     console.error('Error getting customer code:', error)
     throw createError({
-      statusCode: error.statusCode || 500,
-      statusMessage: error.message || 'Failed to get customer code'
+      statusCode: 500,
+      statusMessage: 'An unexpected error occurred'
     })
   }
 })

server/api/helcim/customer.post.js

@@ -9,15 +9,7 @@ export default defineEventHandler(async (event) => {
   try {
     await connectDB()
     const config = useRuntimeConfig(event)
-    const body = await readBody(event)
-    
-    // Validate required fields
-    if (!body.name || !body.email) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: 'Name and email are required'
-      })
-    }
+    const body = await validateBody(event, helcimCustomerSchema)
 
     // Check if member already exists
     const existingMember = await Member.findOne({ email: body.email })
@@ -58,7 +50,7 @@ export default defineEventHandler(async (event) => {
       console.error('Connection test failed:', testError)
       throw createError({
         statusCode: 401,
-        statusMessage: `Helcim API connection failed: ${testError.message}`
+        statusMessage: 'Payment service unavailable'
       })
     }
 
@@ -82,7 +74,7 @@ export default defineEventHandler(async (event) => {
       console.error('Customer creation failed:', customerResponse.status, errorText)
       throw createError({
         statusCode: customerResponse.status,
-        statusMessage: `Failed to create customer: ${errorText}`
+        statusMessage: 'Customer creation failed'
       })
     }
     
@@ -133,10 +125,11 @@ export default defineEventHandler(async (event) => {
       }
     }
   } catch (error) {
+    if (error.statusCode) throw error
     console.error('Error creating Helcim customer:', error)
     throw createError({
-      statusCode: error.statusCode || 500,
-      statusMessage: error.message || 'Failed to create customer'
+      statusCode: 500,
+      statusMessage: 'An unexpected error occurred'
     })
   }
 })

server/api/helcim/get-or-create-customer.post.js

@@ -100,7 +100,7 @@ export default defineEventHandler(async (event) => {
       console.error('Failed to create Helcim customer:', createResponse.status, errorText)
       throw createError({
         statusCode: createResponse.status,
-        statusMessage: `Failed to create Helcim customer: ${errorText}`
+        statusMessage: 'Customer creation failed'
       })
     }
 
@@ -118,10 +118,11 @@ export default defineEventHandler(async (event) => {
     }
 
   } catch (error) {
+    if (error.statusCode) throw error
     console.error('Error in get-or-create-customer:', error)
     throw createError({
-      statusCode: error.statusCode || 500,
-      statusMessage: error.message || 'Failed to get or create customer'
+      statusCode: 500,
+      statusMessage: 'An unexpected error occurred'
     })
   }
 })

server/api/helcim/initialize-payment.post.js

@@ -7,7 +7,7 @@ export default defineEventHandler(async (event) => {
   try {
     await requireAuth(event);
     const config = useRuntimeConfig(event);
-    const body = await readBody(event);
+    const body = await validateBody(event, helcimInitializePaymentSchema);
 
 
     const helcimToken =
@@ -64,7 +64,7 @@ export default defineEventHandler(async (event) => {
       );
       throw createError({
         statusCode: response.status,
-        statusMessage: `Failed to initialize payment: ${errorText}`,
+        statusMessage: 'Payment initialization failed',
       });
     }
 
@@ -76,10 +76,11 @@ export default defineEventHandler(async (event) => {
       secretToken: paymentData.secretToken,
     };
   } catch (error) {
+    if (error.statusCode) throw error;
     console.error("Error initializing HelcimPay:", error);
     throw createError({
-      statusCode: error.statusCode || 500,
-      statusMessage: error.message || "Failed to initialize payment",
+      statusCode: 500,
+      statusMessage: "An unexpected error occurred",
     });
   }
 });

server/api/helcim/plans.get.js

@@ -3,6 +3,7 @@ const HELCIM_API_BASE = 'https://api.helcim.com/v2'
 
 export default defineEventHandler(async (event) => {
   try {
+    await requireAdmin(event)
     const config = useRuntimeConfig(event)
     const helcimToken = config.public.helcimToken || process.env.NUXT_PUBLIC_HELCIM_TOKEN
     
@@ -30,10 +31,11 @@ export default defineEventHandler(async (event) => {
     }
     
   } catch (error) {
+    if (error.statusCode) throw error
     console.error('Error fetching Helcim payment plans:', error)
     throw createError({
-      statusCode: error.statusCode || 500,
-      statusMessage: error.message || 'Failed to fetch payment plans'
+      statusCode: 500,
+      statusMessage: 'An unexpected error occurred'
     })
   }
 })

server/api/helcim/subscription.post.js

@@ -76,22 +76,7 @@ export default defineEventHandler(async (event) => {
     await requireAuth(event)
     await connectDB()
     const config = useRuntimeConfig(event)
-    const body = await readBody(event)
-    
-    // Validate required fields
-    if (!body.customerId || !body.contributionTier) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: 'Customer ID and contribution tier are required'
-      })
-    }
-    
-    if (!body.customerCode) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: 'Customer code is required for subscription creation'
-      })
-    }
+    const body = await validateBody(event, helcimSubscriptionSchema)
 
     // Check if payment is required
     if (!requiresPayment(body.contributionTier)) {
@@ -112,7 +97,14 @@ export default defineEventHandler(async (event) => {
       return {
         success: true,
         subscription: null,
-        member
+        member: {
+          id: member._id,
+          email: member.email,
+          name: member.name,
+          circle: member.circle,
+          contributionTier: member.contributionTier,
+          status: member.status
+        }
       }
     }
 
@@ -152,7 +144,14 @@ export default defineEventHandler(async (event) => {
           status: 'needs_plan_setup',
           nextBillingDate: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000)
         },
-        member,
+        member: {
+          id: member._id,
+          email: member.email,
+          name: member.name,
+          circle: member.circle,
+          contributionTier: member.contributionTier,
+          status: member.status
+        },
         warning: `Payment successful but recurring plan needs to be set up in Helcim for the ${body.contributionTier} tier`
       }
     }
@@ -222,17 +221,23 @@ export default defineEventHandler(async (event) => {
             subscription: {
               subscriptionId: 'manual-' + Date.now(),
               status: 'needs_setup',
-              error: errorText,
               nextBillingDate: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000)
             },
-            member,
+            member: {
+              id: member._id,
+              email: member.email,
+              name: member.name,
+              circle: member.circle,
+              contributionTier: member.contributionTier,
+              status: member.status
+            },
             warning: 'Payment successful but recurring subscription needs manual setup'
           }
         }
         
         throw createError({
           statusCode: subscriptionResponse.status,
-          statusMessage: `Failed to create subscription: ${errorText}`
+          statusMessage: 'Subscription creation failed'
         })
       }
       
@@ -267,7 +272,14 @@ export default defineEventHandler(async (event) => {
           status: subscription.status,
           nextBillingDate: subscription.nextBillingDate
         },
-        member
+        member: {
+          id: member._id,
+          email: member.email,
+          name: member.name,
+          circle: member.circle,
+          contributionTier: member.contributionTier,
+          status: member.status
+        }
       }
     } catch (fetchError) {
       console.error('Error during subscription creation:', fetchError)
@@ -294,18 +306,25 @@ export default defineEventHandler(async (event) => {
         subscription: {
           subscriptionId: 'manual-' + Date.now(),
           status: 'needs_setup',
-          error: fetchError.message,
           nextBillingDate: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000)
         },
-        member,
+        member: {
+          id: member._id,
+          email: member.email,
+          name: member.name,
+          circle: member.circle,
+          contributionTier: member.contributionTier,
+          status: member.status
+        },
         warning: 'Payment successful but recurring subscription needs manual setup'
       }
     }
   } catch (error) {
+    if (error.statusCode) throw error
     console.error('Error creating Helcim subscription:', error)
     throw createError({
-      statusCode: error.statusCode || 500,
-      statusMessage: error.message || 'Failed to create subscription'
+      statusCode: 500,
+      statusMessage: 'An unexpected error occurred'
     })
   }
 })

server/api/helcim/subscriptions.get.js

@@ -3,6 +3,7 @@ const HELCIM_API_BASE = 'https://api.helcim.com/v2'
 
 export default defineEventHandler(async (event) => {
   try {
+    await requireAdmin(event)
     const config = useRuntimeConfig(event)
     const helcimToken = config.public.helcimToken || process.env.NUXT_PUBLIC_HELCIM_TOKEN
     
@@ -30,10 +31,11 @@ export default defineEventHandler(async (event) => {
     }
     
   } catch (error) {
+    if (error.statusCode) throw error
     console.error('Error fetching Helcim subscriptions:', error)
     throw createError({
-      statusCode: error.statusCode || 500,
-      statusMessage: error.message || 'Failed to fetch subscriptions'
+      statusCode: 500,
+      statusMessage: 'An unexpected error occurred'
     })
   }
 })

server/api/helcim/update-billing.post.js

@@ -7,25 +7,9 @@ export default defineEventHandler(async (event) => {
   try {
     await requireAuth(event)
     const config = useRuntimeConfig(event)
-    const body = await readBody(event)
-    
-    // Validate required fields
-    if (!body.customerId || !body.billingAddress) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: 'Customer ID and billing address are required'
-      })
-    }
+    const body = await validateBody(event, helcimUpdateBillingSchema)
 
     const { billingAddress } = body
-    
-    // Validate billing address fields
-    if (!billingAddress.street || !billingAddress.city || !billingAddress.country || !billingAddress.postalCode) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: 'Complete billing address is required'
-      })
-    }
 
     const helcimToken = config.public.helcimToken || process.env.NUXT_PUBLIC_HELCIM_TOKEN
     
@@ -54,7 +38,7 @@ export default defineEventHandler(async (event) => {
       console.error('Billing address update failed:', response.status, errorText)
       throw createError({
         statusCode: response.status,
-        statusMessage: `Failed to update billing address: ${errorText}`
+        statusMessage: 'Billing update failed'
       })
     }
     
@@ -65,10 +49,11 @@ export default defineEventHandler(async (event) => {
       customer: customerData
     }
   } catch (error) {
+    if (error.statusCode) throw error
     console.error('Error updating billing address:', error)
     throw createError({
-      statusCode: error.statusCode || 500,
-      statusMessage: error.message || 'Failed to update billing address'
+      statusCode: 500,
+      statusMessage: 'An unexpected error occurred'
     })
   }
 })

server/api/members/create.post.js

@@ -100,14 +100,24 @@ export default defineEventHandler(async (event) => {
 
     // TODO: Send welcome email
     
-    return { success: true, member }
+    return {
+      success: true,
+      member: {
+        id: member._id,
+        email: member.email,
+        name: member.name,
+        circle: member.circle,
+        contributionTier: member.contributionTier,
+        status: member.status
+      }
+    }
   } catch (error) {
     if (error.statusCode) {
       throw error
     }
-    throw createError({ 
-      statusCode: 400, 
-      statusMessage: error.message 
+    throw createError({
+      statusCode: 400,
+      statusMessage: 'Member creation failed'
     })
   }
 })

server/api/members/me/peer-support.patch.js

@@ -25,7 +25,7 @@ export default defineEventHandler(async (event) => {
     });
   }
 
-  const body = await readBody(event);
+  const body = await validateBody(event, peerSupportUpdateSchema);
 
   // Build update object for peer support settings
   const updateData = {

server/api/members/update-contribution.post.js

@@ -14,7 +14,7 @@ export default defineEventHandler(async (event) => {
   try {
     await connectDB();
     const config = useRuntimeConfig(event);
-    const body = await readBody(event);
+    const body = await validateBody(event, updateContributionSchema);
     const token = getCookie(event, "auth-token");
 
     if (!token) {
@@ -35,17 +35,6 @@ export default defineEventHandler(async (event) => {
       });
     }
 
-    // Validate contribution tier
-    if (
-      !body.contributionTier ||
-      !isValidContributionValue(body.contributionTier)
-    ) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: "Invalid contribution tier",
-      });
-    }
-
     // Get member
     const member = await Member.findById(decoded.memberId);
     if (!member) {
@@ -63,7 +52,6 @@ export default defineEventHandler(async (event) => {
       return {
         success: true,
         message: "Already on this tier",
-        member,
       };
     }
 
@@ -186,7 +174,7 @@ export default defineEventHandler(async (event) => {
         if (!subscriptionResponse.ok) {
           const errorText = await subscriptionResponse.text();
           console.error("Failed to create subscription:", errorText);
-          throw new Error(`Failed to create subscription: ${errorText}`);
+          throw new Error('Subscription creation failed');
         }
 
         const subscriptionData = await subscriptionResponse.json();
@@ -206,7 +194,6 @@ export default defineEventHandler(async (event) => {
         return {
           success: true,
           message: "Successfully upgraded to paid tier",
-          member,
           subscription: {
             subscriptionId: subscription.id,
             status: subscription.status,
@@ -262,7 +249,6 @@ export default defineEventHandler(async (event) => {
       return {
         success: true,
         message: "Successfully downgraded to free tier",
-        member,
       };
     }
 
@@ -311,7 +297,7 @@ export default defineEventHandler(async (event) => {
             response.status,
             errorText,
           );
-          throw new Error(`Failed to update subscription: ${errorText}`);
+          throw new Error('Subscription update failed');
         }
 
         const subscriptionData = await response.json();
@@ -323,14 +309,13 @@ export default defineEventHandler(async (event) => {
         return {
           success: true,
           message: "Successfully updated contribution level",
-          member,
           subscription: subscriptionData,
         };
       } catch (error) {
         console.error("Error updating Helcim subscription:", error);
         throw createError({
           statusCode: 500,
-          statusMessage: error.message || "Failed to update subscription",
+          statusMessage: "Subscription update failed",
         });
       }
     }
@@ -342,13 +327,13 @@ export default defineEventHandler(async (event) => {
     return {
       success: true,
       message: "Successfully updated contribution level",
-      member,
     };
   } catch (error) {
+    if (error.statusCode) throw error;
     console.error("Error updating contribution tier:", error);
     throw createError({
-      statusCode: error.statusCode || 500,
-      statusMessage: error.message || "Failed to update contribution tier",
+      statusCode: 500,
+      statusMessage: "An unexpected error occurred",
     });
   }
 });

server/api/series/[id]/tickets/check-eligibility.post.js

@@ -2,17 +2,10 @@ import Member from "../../../../models/member.js";
 
 export default defineEventHandler(async (event) => {
   try {
-    const body = await readBody(event);
+    const body = await validateBody(event, seriesTicketEligibilitySchema);
     const { email } = body;
 
-    if (!email) {
-      return {
-        isMember: false,
-        message: "Email is required",
-      };
-    }
-
-    const member = await Member.findOne({ email: email.toLowerCase() });
+    const member = await Member.findOne({ email });
 
     if (!member) {
       return {

server/api/series/[id]/tickets/purchase.post.js

@@ -14,17 +14,9 @@ import { sendSeriesPassConfirmation } from "../../../../utils/resend.js";
 export default defineEventHandler(async (event) => {
   try {
     const seriesId = getRouterParam(event, "id");
-    const body = await readBody(event);
+    const body = await validateBody(event, seriesTicketPurchaseSchema);
     const { name, email, paymentId } = body;
 
-    // Validate input
-    if (!name || !email) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: "Name and email are required",
-      });
-    }
-
     // Fetch series
     // Build query conditions based on whether seriesId looks like ObjectId or string
     const isObjectId = /^[0-9a-fA-F]{24}$/.test(seriesId);

server/api/test/peer-support-debug.get.js

@@ -1,28 +0,0 @@
-import jwt from "jsonwebtoken";
-import Member from "../../models/member.js";
-import { connectDB } from "../../utils/mongoose.js";
-
-export default defineEventHandler(async (event) => {
-  await connectDB();
-
-  const token = getCookie(event, "auth-token");
-  if (!token) {
-    throw createError({ statusCode: 401, statusMessage: "Not authenticated" });
-  }
-
-  let memberId;
-  try {
-    const decoded = jwt.verify(token, useRuntimeConfig().jwtSecret);
-    memberId = decoded.memberId;
-  } catch (err) {
-    throw createError({ statusCode: 401, statusMessage: "Invalid token" });
-  }
-
-  const member = await Member.findById(memberId).select("name peerSupport slackUserId");
-
-  return {
-    name: member.name,
-    peerSupport: member.peerSupport,
-    slackUserId: member.slackUserId,
-  };
-});

server/api/updates/[id].patch.js

@@ -26,7 +26,7 @@ export default defineEventHandler(async (event) => {
   }
 
   const id = getRouterParam(event, "id");
-  const body = await readBody(event);
+  const body = await validateBody(event, updatePatchSchema);
 
   try {
     const update = await Update.findById(id);