Merge pull request #152 from kaonis/feat/147-zod-v4-migration-validation

fix(deps): validate and migrate Zod v4 compatibility across services

Author: kaonis

apps/cnc/package.json

@@ -46,7 +46,7 @@
     "swagger-ui-express": "^5.0.1",
     "winston": "^3.17.0",
     "ws": "^8.18.3",
-    "zod": "^3.24.1"
+    "zod": "^4.0.0"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",

apps/cnc/src/controllers/hosts.ts

@@ -3,6 +3,7 @@
  */
 
 import { Request, Response } from 'express';
+import { isIP } from 'node:net';
 import { z } from 'zod';
 import { hostStatusSchema } from '@kaonis/woly-protocol';
 import { HostAggregator } from '../services/hostAggregator';
@@ -11,10 +12,14 @@ import { lookupMacVendor, MAC_ADDRESS_PATTERN } from '../services/macVendorServi
 import logger from '../utils/logger';
 
 // Validation schema for updateHost request body
+const ipAddressSchema = z.string().refine((value) => isIP(value) !== 0, {
+  message: 'IP address must be a valid IPv4 or IPv6 address',
+});
+
 const updateHostBodySchema = z.object({
   name: z.string().min(1).optional(),
   mac: z.string().regex(MAC_ADDRESS_PATTERN).optional(),
-  ip: z.string().ip().optional(),
+  ip: ipAddressSchema.optional(),
   status: hostStatusSchema.optional(),
 }).strict();
 
@@ -322,7 +327,7 @@ export class HostsController {
         res.status(400).json({
           error: 'Bad Request',
           message: 'Invalid request body',
-          details: parseResult.error.errors,
+          details: parseResult.error.issues,
         });
         return;
       }

apps/node-agent/package.json

@@ -49,7 +49,7 @@
     "wake_on_lan": "1.0.0",
     "winston": "^3.17.0",
     "ws": "^8.18.3",
-    "zod": "^3.24.1"
+    "zod": "^4.0.0"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",

apps/node-agent/src/middleware/__tests__/validateRequest.unit.test.ts

@@ -62,6 +62,15 @@ describe('validateRequest middleware', () => {
         middleware(mockReq as Request, mockRes as Response, mockNext);
       }).toThrow(AppError);
 
+      try {
+        middleware(mockReq as Request, mockRes as Response, mockNext);
+        fail('Should have thrown AppError');
+      } catch (error) {
+        expect(error).toBeInstanceOf(AppError);
+        expect((error as AppError).message.toLowerCase()).toContain('required');
+        expect((error as AppError).message).toContain('email');
+      }
+
       expect(mockNext).not.toHaveBeenCalled();
     });
 

apps/node-agent/src/middleware/validateRequest.ts

@@ -28,10 +28,15 @@ export const validateRequest = (schema: z.ZodTypeAny, target: ValidationTarget =
     } catch (error) {
       if (error instanceof ZodError) {
         // Format errors to match Joi format: comma-separated error messages with field paths
-        const errorMessage = error.errors
+        const errorMessage = error.issues
           .map((err) => {
             const path = err.path.length > 0 ? `"${err.path.join('.')}" ` : '';
-            return `${path}${err.message}`;
+            const isMissingRequiredField =
+              err.code === 'invalid_type' &&
+              (err as { input?: unknown }).input === undefined &&
+              err.path.length > 0;
+            const message = isMissingRequiredField ? 'is required' : err.message;
+            return `${path}${message}`;
           })
           .join(', ');
         throw new AppError(errorMessage, 400, 'VALIDATION_ERROR');

apps/node-agent/src/validators/__tests__/hostValidator.unit.test.ts

@@ -58,7 +58,7 @@ describe('hostValidator schemas', () => {
       const result = updateHostSchema.safeParse({});
       expect(result.success).toBe(false);
       if (!result.success) {
-        expect(result.error.errors[0]?.message).toContain('At least one field is required');
+        expect(result.error.issues[0]?.message).toContain('At least one field is required');
       }
     });
 

apps/node-agent/src/validators/hostValidator.ts

@@ -1,10 +1,14 @@
 import { z } from 'zod';
+import { isIP } from 'node:net';
 
 /**
  * MAC address validation pattern
  * Accepts formats: XX:XX:XX:XX:XX:XX or XX-XX-XX-XX-XX-XX
  */
 const macAddressPattern = /^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$/;
+const ipAddressSchema = z.string().refine((value) => isIP(value) !== 0, {
+  message: 'IP address must be a valid IPv4 or IPv6 address',
+});
 
 /**
  * Schema for validating MAC address parameter
@@ -18,7 +22,7 @@ export const macAddressSchema = z.object({
  */
 export const addHostSchema = z.object({
   name: z.string().min(1, 'Hostname must be at least 1 character').max(255, 'Hostname must not exceed 255 characters').trim(),
-  ip: z.string().ip('IP address must be a valid IPv4 or IPv6 address'),
+  ip: ipAddressSchema,
   mac: z.string().regex(macAddressPattern, 'MAC address must be in format XX:XX:XX:XX:XX:XX or XX-XX-XX-XX-XX-XX'),
 });
 
@@ -33,7 +37,7 @@ export const updateHostSchema = z
       .max(255, 'Hostname must not exceed 255 characters')
       .trim()
       .optional(),
-    ip: z.string().ip('IP address must be a valid IPv4 or IPv6 address').optional(),
+    ip: ipAddressSchema.optional(),
     mac: z
       .string()
       .regex(

docs/ROADMAP_V6.md

@@ -6,19 +6,17 @@ Scope: New autonomous cycle after V5 completion.
 ## 1. Status Audit
 
 ### Repository and branch status
-- `master` synced at merge commit `9b027df` (PR #145).
+- `master` synced at merge commit `1c82368` (PR #151).
 - Active execution branch: `master`.
 
 ### Open issue snapshot (`kaonis/woly-server`)
 - #4 `Dependency Dashboard`
-- #144 `[Dependencies] Plan major dashboard upgrade wave (ESLint 10, TS-ESLint 8, Zod 4, npm 11)`
-- #146 `[Dependencies] Execute tooling major upgrade set (ESLint 9 + typescript-eslint 8)`
 - #147 `[Dependencies] Evaluate and stage Zod v4 migration across protocol and services`
 - #148 `[Dependencies] Evaluate npm 11 adoption and CI/runtime compatibility`
 - #150 `[Dependencies] Revisit ESLint 10 adoption after typescript-eslint compatibility`
 
 ### CI snapshot
-- Post-merge checks for `9b027df` are green (CI + CodeQL).
+- Post-merge checks for `1c82368` are green (CI + CodeQL).
 - Dependency triage workflow and audit/security gates are documented and active.
 
 ## 2. Iterative Phases
@@ -43,7 +41,7 @@ Acceptance criteria:
 - Keep lint/typecheck/test gates green across workspaces.
 - Document any lint rule/config migration adjustments.
 
-Status: `In Progress` (2026-02-15)
+Status: `Completed` (2026-02-15, PR #151)
 
 ### Phase 3: Zod v4 migration validation
 Issue: #147  
@@ -54,7 +52,7 @@ Acceptance criteria:
 - Preserve contract compatibility or document deliberate breaking changes.
 - Keep CI and contract/schema suites green.
 
-Status: `Pending`
+Status: `In Progress` (2026-02-15)
 
 ## 3. Execution Loop Rules
 
@@ -82,3 +80,9 @@ For each phase:
 - 2026-02-15: Started Phase 2 issue #146 on branch `feat/146-tooling-major-upgrade-set`.
 - 2026-02-15: Upgraded lint tooling to ESLint 9 + typescript-eslint 8 + eslint-config-prettier 10 and stabilized ESLint v9 compatibility for current `.eslintrc` workflow.
 - 2026-02-15: Ran local root gates for #146 (`npm run lint`, `npm run typecheck`, `npm run test:ci`) successfully.
+- 2026-02-15: Merged #146 via PR #151 and verified post-merge `master` checks green (CI + CodeQL).
+- 2026-02-15: Started Phase 3 issue #147 on branch `feat/147-zod-v4-migration-validation`.
+- 2026-02-15: Applied Zod v4 migration updates across protocol/C&C/node-agent (`zod` dependency majors, IP validation migration from `z.string().ip()` to `node:net` `isIP` refinements, `ZodError.errors` -> `ZodError.issues`).
+- 2026-02-15: Ran full local gates for #147 (`npm run typecheck`, `npm run test:ci`, `npm run lint`, `npm run build`) successfully.
+- 2026-02-15: Addressed PR #152 CI regression in node-agent validation messaging by normalizing missing-field errors back to `is required` semantics and adding unit coverage for the behavior.
+- 2026-02-15: Re-ran full local gates for #147 (`npm run typecheck`, `npm run test:ci`, `npm run lint`, `npm run build`) successfully after CI-fix patch.

package-lock.json

@@ -32,7 +32,7 @@
     "access": "public"
   },
   "dependencies": {
-    "zod": "^3.24.1"
+    "zod": "^4.0.0"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",