feat: update clientTimezone regex to support additional characters and add tests for heatmap and views endpoints

Author: c-c-epr

server/api/stats/heatmap.get.ts

@@ -6,7 +6,7 @@ const { select } = SqlBricks
 
 const HeatmapQuerySchema = QuerySchema.extend({
   clientTimezone: z.string()
-    .regex(/^[A-Z_]+(?:\/[A-Z_-]+)*$/i)
+    .regex(/^[\w+-]+(?:\/[\w+-]+)*$/)
     .max(64)
     .default('Etc/UTC'),
 })

server/api/stats/views.get.ts

@@ -13,7 +13,7 @@ const unitMap: { [x: string]: string } = {
 const ViewsQuerySchema = QuerySchema.extend({
   unit: z.enum(['minute', 'hour', 'day']),
   clientTimezone: z.string()
-    .regex(/^[A-Z_]+(?:\/[A-Z_-]+)*$/i)
+    .regex(/^[\w+-]+(?:\/[\w+-]+)*$/)
     .max(64)
     .default('Etc/UTC'),
 })

tests/api/stats.spec.ts

@@ -100,6 +100,12 @@ describe('/api/stats/views', () => {
     expect(response.status).toBe(200)
   })
 
+  it('supports offset-style clientTimezone values', async () => {
+    const response = await fetchWithAuth('/api/stats/views?slug=0&unit=day&clientTimezone=Etc/GMT-8')
+
+    expect(response.status).toBe(200)
+  })
+
   it('returns 400 for invalid clientTimezone format', async () => {
     const response = await fetchWithAuth('/api/stats/views?slug=0&unit=day&clientTimezone=invalid<>timezone')
 
@@ -124,3 +130,29 @@ describe('/api/stats/views', () => {
     expect(response.status).toBe(401)
   })
 })
+
+describe('/api/stats/heatmap', () => {
+  it('supports clientTimezone parameter', async () => {
+    const response = await fetchWithAuth('/api/stats/heatmap?clientTimezone=Asia/Shanghai')
+
+    expect(response.status).toBe(200)
+  })
+
+  it('supports offset-style clientTimezone values', async () => {
+    const response = await fetchWithAuth('/api/stats/heatmap?clientTimezone=Etc/GMT-8')
+
+    expect(response.status).toBe(200)
+  })
+
+  it('returns 400 for invalid clientTimezone format', async () => {
+    const response = await fetchWithAuth('/api/stats/heatmap?clientTimezone=invalid<>timezone')
+
+    expect(response.status).toBe(400)
+  })
+
+  it('returns 401 when accessing without auth', async () => {
+    const response = await fetch('/api/stats/heatmap?clientTimezone=Asia/Shanghai')
+
+    expect(response.status).toBe(401)
+  })
+})