JUNOHUB-test/docs/qa/pr-validation-checklist.md

PR checklist: validation and API safety

Use this for any change that adds or modifies user input, public endpoints, or tenant-scoped data.

1. Server schema: Mutating handlers (POST / PUT / PATCH / DELETE) that read JSON should validate with Zod (safeParse) and return structured 400 responses (see validationErrorResponse in src/lib/api-schemas/validate.ts).
2. Rate limits: Unauthenticated or abuse-prone endpoints should use applyRateLimit from src/lib/rate-limit.ts with an explicit window and max.
3. Authorization: For routes with storeId, supplierId, connectionId, orderId, etc., confirm the authenticated user owns or is linked to that resource before mutating.
4. Client parity: High-traffic forms should mirror server limits (maxLength, optional Zod pre-check) for UX; never rely on client checks alone for security.
5. HTML / XSS: If user content is rendered as HTML, sanitize or use textContent / escaped strings; see src/lib/sanitize/htmlPolicy.ts.
6. Tests: Add or extend Zod unit tests in src/lib/api-schemas/schemas.test.ts for new schemas; add route-level tests when authz behavior is non-obvious.
7. E2E (optional): With the dev server running, PLAYWRIGHT_BASE_URL=http://127.0.0.1:3000 pnpm exec playwright test.