Skip to content
astro-doctor
Securitywarn by defaultrecommended presetastro-doctor/require-action-input-schema

require-action-input-schema

Validate untrusted Astro Action input before the handler runs.

Why

Astro Actions are public endpoints. An input schema rejects malformed or unexpected request data before it reaches application logic and gives the handler typed input.

Examples

Incorrect

Handler consumes input without validation

typescript
export const server = {
  createUser: defineAction({
    handler: async (input) => createUser(input),
  }),
}

Correct

Validate input with a schema

typescript
import { z } from 'astro:schema'

export const server = {
  createUser: defineAction({
    input: z.object({
      email: z.string().email(),
    }),
    handler: async ({ email }) => createUser({ email }),
  }),
}

Configuration

Project audits are configured in doctor.config.ts:

typescriptdoctor.config.ts
export default {
            rules: {
              'astro-doctor/require-action-input-schema': 'error', // or 'warn' or 'off'
            },
          }

All rules

Edit this page on GitHub ↗