refactor: migrate DTOs from class-validator to Zod (#2542)

* feat: init zod

* refactor(draft, meta-preset): migrate DTOs to Zod schemas and clean up models

- Replaced class-validator DTOs with Zod schemas for CreateDraft, UpdateDraft, and related models in the Draft module.
- Removed unused draft.dto.ts and meta-preset.dto.ts files, consolidating validation logic into draft.schema.ts and meta-preset.schema.ts.
- Updated service and controller files to reference the new Zod-based DTOs.
- Cleaned up model definitions by removing unnecessary decorators and imports.

Signed-off-by: Innei <[email protected]>

* chore: update zod dependency and refactor validation logic

- Upgraded zod from version 3.25.76 to 4.3.5 across various modules and schemas.
- Removed deprecated class-validator dependencies and validation pipes, consolidating validation logic using Zod.
- Updated schemas to utilize z.enum for enum types instead of z.nativeEnum for better compatibility with Zod v4.
- Cleaned up imports and adjusted related service and controller files to align with the new validation approach.

Signed-off-by: Innei <[email protected]>

* feat(post): add category filtering to post pagination and update PostPagerDto

- Enhanced the PostController to support category-based filtering in post queries.
- Updated PostPagerDto to include categoryIds, allowing for flexible filtering of posts by categories.
- Refactored the selection logic in the aggregation pipeline for improved readability and performance.

Signed-off-by: Innei <[email protected]>

* feat(draft): enhance draft management with published version tracking

- Added `publishedVersion` property to `DraftModel` to track the version of the draft when it was published.
- Updated `DraftService` to include `markAsPublished` method for marking drafts as published and synchronizing their version.
- Modified `NoteService`, `PageService`, and `PostService` to handle draft publication during note, page, and post creation and updates, respectively.
- Introduced `draftId` field in schemas for Note, Page, and Post to associate drafts with published content.

Signed-off-by: Innei <[email protected]>

* chore: update schemas to include missing imports and refactor validation logic

- Added missing imports in comment.schema.ts, configs.schema.ts, markdown.schema.ts, and webhook.schema.ts for consistency.
- Refactored BaseCrudFactory in crud-factor.transformer.ts to simplify DTO class definitions, removing PartialType and clarifying validation handling.
- Updated test files to replace ExtendedValidationPipe with extendedZodValidationPipeInstance for improved validation consistency.
- Adjusted e2e tests for OptionController to reflect changes in the API endpoint and response structure.

Signed-off-by: Innei <[email protected]>

* chore: remove cls-hooked dependency and implement AsyncLocalStorage for request context management

- Removed cls-hooked from package.json and pnpm-lock.yaml to simplify dependency management.
- Refactored RequestContext to utilize AsyncLocalStorage for storing request context, enhancing performance and reducing complexity.
- Updated RequestContextMiddleware to use the new AsyncLocalStorage implementation.
- Added Redis server installation step in CI workflow and improved Redis mock setup to locate the system binary.

Signed-off-by: Innei <[email protected]>

* test: add end-to-end and unit tests for RequestContext management

- Introduced e2e tests in request.context.e2e-spec.ts to verify that the RequestContext maintains consistency throughout a request lifecycle and does not leak context across concurrent requests.
- Added unit tests in request.context.spec.ts to ensure proper context management during asynchronous operations and isolation of concurrent request contexts.

Signed-off-by: Innei <[email protected]>

* Potential fix for code scanning alert no. 66: Unvalidated dynamic method call

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Innei <[email protected]>

* chore: replace lodash with es-toolkit and update dependencies

- Removed lodash imports across various modules and replaced them with equivalent functions from es-toolkit/compat.
- Added es-toolkit as a dependency in package.json and pnpm-lock.yaml.
- Updated related configuration files to reflect the removal of lodash.

Signed-off-by: Innei <[email protected]>

* fix(snippet): update SnippetModel type property to include enum validation

- Modified the `type` property in SnippetModel to include an enum validation for SnippetType, ensuring that only valid types can be assigned.
- Removed outdated snapshot tests for NoteController to streamline test suite and reduce clutter.

Signed-off-by: Innei <[email protected]>

* refactor: update API routes to use dynamic prefix and enhance SnippetModel type validation

- Refactored various controller tests to utilize a dynamic API route prefix for improved maintainability.
- Updated the `type` property in SnippetModel to ensure enum validation is based on `Object.values(SnippetType)` for better type safety.

Signed-off-by: Innei <[email protected]>

---------

Signed-off-by: Innei <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: Innei

.github/workflows/ci.yml

@@ -99,9 +99,14 @@ jobs:
         uses: ./.github/actions/setup-node
         with:
           node-version: '22.x'
+      - name: Install Redis Server
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y redis-server
       - name: Run Lint
         run: npm run lint
       - name: Run Tests
         run: npm run test
         env:
           CI: true
+          REDIS_BINARY_PATH: /usr/bin/redis-server

apps/core/CHANGELOG.md

@@ -1 +1 @@
-This is folder used to override dependencies.
+This is folder used to override dependencies.

apps/core/external/readme.md

@@ -85,15 +85,12 @@
     "bcryptjs": "^3.0.3",
     "blurhash": "2.0.5",
     "cache-manager": "7.2.8",
-    "class-transformer": "0.5.1",
-    "class-validator": "0.13.2",
-    "class-validator-jsonschema": "npm:@innei/[email protected]",
-    "cls-hooked": "^4.2.2",
     "commander": "14.0.2",
     "dayjs": "1.11.19",
     "dotenv": "^17.2.3",
     "dotenv-expand": "^12.0.3",
     "ejs": "3.1.10",
+    "es-toolkit": "^1.44.0",
     "form-data": "4.0.5",
     "inquirer": "^12.9.6",
     "isbot": "5.1.32",
@@ -103,7 +100,6 @@
     "jszip": "3.10.1",
     "keyv": "5.5.5",
     "linkedom": "0.18.12",
-    "lodash": "^4.17.21",
     "lru-cache": "11.2.4",
     "marked": "16.3.0",
     "mime-types": "^3.0.1",
@@ -114,6 +110,7 @@
     "mongoose-lean-getters": "2.2.2",
     "mongoose-lean-virtuals": "2.0.1",
     "mongoose-paginate-v2": "1.9.1",
+    "nestjs-zod": "^5.1.1",
     "node-machine-id": "1.1.12",
     "nodemailer": "7.0.12",
     "openai": "5.23.2",
@@ -131,6 +128,7 @@
     "vm2": "3.9.19",
     "wildcard-match": "5.1.4",
     "xss": "1.0.15",
+    "zod": "4.3.5",
     "zx-cjs": "7.0.7-0"
   },
   "devDependencies": {
@@ -139,11 +137,9 @@
     "@nestjs/testing": "11.1.12",
     "@swc/core": "1.15.8",
     "@types/babel__core": "7.20.5",
-    "@types/cls-hooked": "^4.3.9",
     "@types/ejs": "3.1.5",
     "@types/get-image-colors": "4.0.5",
     "@types/js-yaml": "4.0.9",
-    "@types/lodash": "4.17.23",
     "@types/mime-types": "3.0.1",
     "@types/node": "25.0.9",
     "@types/nodemailer": "6.4.21",
@@ -165,4 +161,4 @@
     "vite-tsconfig-paths": "6.0.4",
     "vitest": "1.5.2"
   }
-}
+}

apps/core/package.json

@@ -111,7 +111,6 @@ pnpm dev
 ## 应用结构
 
 - 请求处理流程
-
   1. request：收到请求
   1. middleware：中间件过滤爬虫 PHP 肉鸡扫描路径，记录访问历史
   1. guard：守卫过滤（鉴权）和角色附加
@@ -129,7 +128,6 @@ ResponseInterceptor -> ResponseFilterInterceptor -> JSONTransformInterceptor ->
 ```
 
 - [业务逻辑模块](https://github.com/mx-space/mx-server/tree/master/src/modules)
-
   1. [Aggregate] 聚合
   1. [Analyze] 数据统计
   1. [Auth] 认证

apps/core/readme.md

@@ -13,7 +13,7 @@ import { fastifyApp } from './common/adapters/fastify.adapter'
 import { RedisIoAdapter } from './common/adapters/socket.adapter'
 import { SpiderGuard } from './common/guards/spider.guard'
 import { LoggingInterceptor } from './common/interceptors/logging.interceptor'
-import { ExtendedValidationPipe } from './common/pipes/validation.pipe'
+import { extendedZodValidationPipeInstance } from './common/zod'
 import { logger } from './global/consola.global'
 import { isMainProcess, isTest } from './global/env.global'
 import { checkInit } from './utils/check-init.util'
@@ -78,7 +78,7 @@ export async function bootstrap() {
     app.useGlobalInterceptors(new LoggingInterceptor())
   }
 
-  app.useGlobalPipes(ExtendedValidationPipe.shared)
+  app.useGlobalPipes(extendedZodValidationPipeInstance)
   app.useGlobalGuards(new SpiderGuard())
   !isTest && app.useWebSocketAdapter(new RedisIoAdapter(app))
 

apps/core/src/bootstrap.ts

@@ -1,13 +1,15 @@
 /* eslint-disable dot-notation */
 // @reference https://github.com/ever-co/ever-gauzy/blob/d36b4f40b1446f3c33d02e0ba00b53a83109d950/packages/core/src/core/context/request-context.ts
+import { AsyncLocalStorage } from 'node:async_hooks'
 import type { ServerResponse } from 'node:http'
 import { UnauthorizedException } from '@nestjs/common'
 import type { UserModel } from '~/modules/user/user.model'
 import type { BizIncomingMessage } from '~/transformers/get-req.transformer'
-import * as cls from 'cls-hooked'
 
 type Nullable<T> = T | null
 export class RequestContext {
+  private static readonly storage = new AsyncLocalStorage<RequestContext>()
+
   readonly id: number
   request: BizIncomingMessage
   response: ServerResponse
@@ -18,13 +20,12 @@ export class RequestContext {
     this.response = response
   }
 
-  static currentRequestContext(): Nullable<RequestContext> {
-    const session = cls.getNamespace(RequestContext.name)
-    if (session && session.active) {
-      return session.get(RequestContext.name)
-    }
+  static run<T>(requestContext: RequestContext, callback: () => T): T {
+    return RequestContext.storage.run(requestContext, callback)
+  }
 
-    return null
+  static currentRequestContext(): Nullable<RequestContext> {
+    return RequestContext.storage.getStore() ?? null
   }
 
   static currentRequest(): Nullable<BizIncomingMessage> {

apps/core/src/common/contexts/request.context.ts

@@ -1,4 +1,29 @@
-import { Transform } from 'class-transformer'
+import { createParamDecorator, type ExecutionContext } from '@nestjs/common'
 
-export const TransformBoolean = () =>
-  Transform(({ value }) => value === '1' || value === 'true')
+/**
+ * Transform string query parameter to boolean
+ * '1' or 'true' becomes true, all other values become false
+ *
+ * Note: This decorator is primarily used for query parameter transformation.
+ * For Zod schemas, use z.preprocess() or z.coerce instead.
+ */
+export function transformBoolean(value: unknown): boolean {
+  return value === '1' || value === 'true' || value === true
+}
+
+/**
+ * @deprecated Use Zod schema with z.preprocess() instead
+ * Example:
+ * ```typescript
+ * const schema = z.object({
+ *   enabled: z.preprocess((val) => val === '1' || val === 'true', z.boolean())
+ * })
+ * ```
+ */
+export const TransformBoolean = createParamDecorator(
+  (data: string, ctx: ExecutionContext): boolean => {
+    const request = ctx.switchToHttp().getRequest()
+    const value = request.query?.[data] ?? request.body?.[data]
+    return transformBoolean(value)
+  },
+)

apps/core/src/common/decorators/transform-boolean.decorator.ts

@@ -1,5 +1,5 @@
 import { NotFoundException } from '@nestjs/common'
-import { sample } from 'lodash'
+import { sample } from 'es-toolkit/compat'
 
 export const NotFoundMessage = [
   '真不巧，内容走丢了 o(╥﹏╥)o',

apps/core/src/common/exceptions/cant-find.exception.ts

@@ -6,7 +6,7 @@ import type { UserModel } from '~/modules/user/user.model'
 import { UserService } from '~/modules/user/user.service'
 import type { FastifyBizRequest } from '~/transformers/get-req.transformer'
 import { getNestExecutionContextRequest } from '~/transformers/get-req.transformer'
-import { isJWT } from 'class-validator'
+import { isJWT } from '~/utils/validator.util'
 
 /**
  * JWT auth guard