Verify Zod schema validation for FederalTaxInput at HTTP boundaries

[Copilot]

Confirmed that Zod schema validation has been properly implemented to address CodeRabbit's security review feedback on PR #238.

Validation Implementation

• Schema Definition: FederalTaxInputSchema in tax-formulas.ts (lines 520-537)

  • Required fields: year (2018-2025), filingStatus (enum), wages (non-negative)
  • Optional fields with proper constraints (non-negative numbers, integer counts)

• Boundary Validation: Applied in http-bridge.ts at both endpoints

  • /api/forecast/tax (lines 1059-1071)
  • /api/forecast/tax/pdf (lines 1100-1112)
  • Uses safeParse() with 400 error responses on invalid input
  • Only validated data passed to calculateFederal()

const { calculateFederal, FederalTaxInputSchema } = await import('./modules/forecast/formulas/tax-formulas.js');

const validationResult = FederalTaxInputSchema.safeParse(forecast_input);
if (!validationResult.success) {
  return res.status(400).json({
    success: false,
    error: 'Invalid forecast_input data',
    details: validationResult.error.issues
  });
}

const calculatedValues = calculateFederal(validationResult.data);

Notes

The ForecastHttpRequestSchema still uses z.any() for initial parsing to avoid circular dependencies, but strict validation occurs in the handler before calculation functions are called. This pattern satisfies the security requirement of validating all user inputs at API boundaries.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codacy-production]

Codacy's Analysis Summary

0 new issue (≤ 0 issue)
0 new security issue

Review Pull Request in Codacy →

✨ AI Reviewer available: add the codacy-review label to get contextual insights without leaving GitHub.