validate invite token type on registration

server/src/api/controllers/authController.ts

@@ -5,6 +5,7 @@ import { requireTeamId, requireUserEmail, requireUserId, requireUserRoles } from
 
 import {
 	registrationBodyValidation,
+	registerInviteTokenValidation,
 	loginValidation,
 	recoveryValidation,
 	recoveryTokenBodyValidation,
@@ -48,7 +49,7 @@ class AuthController implements IAuthController {
 
 	registerUser = catchAsync(async (req: Request, res: Response) => {
 		const newUser = req.body.user;
-		const newUserToken = req.body.token;
+		const newUserToken = registerInviteTokenValidation.parse(req.body.token);
 		if (newUser?.email) {
 			const newUserEmail = requireUserEmail(newUser.email);
 			newUser.email = newUserEmail.toLowerCase();

server/src/api/validation/authValidation.ts

@@ -23,6 +23,8 @@ export const registrationBodyValidation = z.object({
 	inviteToken: z.string().optional().default(""),
 });
 
+export const registerInviteTokenValidation = z.string().optional().default("");
+
 export const recoveryValidation = z.object({
 	email: z.email("Must be a valid email address"),
 });

server/test/unit/validation/authValidation.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it } from "@jest/globals";
+import { registerInviteTokenValidation } from "../../../src/api/validation/authValidation.ts";
+
+describe("authValidation", () => {
+	describe("registerInviteTokenValidation", () => {
+		it("accepts a valid token string", () => {
+			expect(registerInviteTokenValidation.parse("a".repeat(64))).toBe("a".repeat(64));
+		});
+
+		it("defaults an absent token to an empty string", () => {
+			expect(registerInviteTokenValidation.parse(undefined)).toBe("");
+		});
+
+		it("rejects a NoSQL operator object in place of a token", () => {
+			expect(() => registerInviteTokenValidation.parse({ $ne: null })).toThrow();
+		});
+
+		it("rejects an array token", () => {
+			expect(() => registerInviteTokenValidation.parse(["a", "b"])).toThrow();
+		});
+	});
+});