refactor(chat-workflow): address PR review — SRP/DRY cleanup

Two review fixes per PR feedback:
1. SRP/DRY — drop the local errorResponse helper from
handleChatWorkflowStream.ts; use the shared
lib/networking/errorResponse and lib/zod/validationErrorResponse
helpers instead.
2. SRP — move auth + body parsing out of handleChatWorkflowStream.ts
into the validator. Rename validateChatWorkflowBody → validateChatWorkflow
so it accepts a full NextRequest (like the existing validateChatRequest)
and returns an auth-augmented body (accountId/orgId/authToken). The
handler now opens with a single `validateChatWorkflow(request)` call.
Tests reshaped to match new seams:
- Validator test mocks validateAuthContext only
- Handler test mocks validateChatWorkflow (the new seam)
- Old "400 invalid JSON" + "400 missing chatId" handler tests collapsed
into a single "validator short-circuit passes through" test — both are
now the validator's responsibility, not the handler's
22/22 new tests green; full suite 2900/2900 pass; lint clean.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sweetmantech

.gitignore

@@ -40,3 +40,4 @@ yarn-error.log*
 # typescript
 *.tsbuildinfo
 next-env.d.ts
+.env*.local

lib/chat/__tests__/handleChatWorkflowStream.test.ts

@@ -2,14 +2,13 @@ import { describe, it, expect, vi, beforeEach } from "vitest";
 import{NextRequest,NextResponse}from"next/server";
 
 import{handleChatWorkflowStream}from"@/lib/chat/handleChatWorkflowStream";
-
-import{validateAuthContext}from"@/lib/auth/validateAuthContext";
+import{validateChatWorkflow}from"@/lib/chat/validateChatWorkflow";
 import{selectSessions}from"@/lib/supabase/sessions/selectSessions";
 import{selectChats}from"@/lib/supabase/chats/selectChats";
 import{isSandboxActive}from"@/lib/sandbox/isSandboxActive";
 
-vi.mock("@/lib/auth/validateAuthContext",()=>({
-validateAuthContext: vi.fn(),
+vi.mock("@/lib/chat/validateChatWorkflow",()=>({
+validateChatWorkflow: vi.fn(),
 }));
 vi.mock("@/lib/supabase/sessions/selectSessions",()=>({
 selectSessions: vi.fn(),
@@ -29,26 +28,27 @@ const OTHER_ACCOUNT_ID = "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb";
 constSESSION_ID="22222222-2222-2222-2222-222222222222";
 constCHAT_ID="11111111-1111-1111-1111-111111111111";
 
-constvalidBody={
-messages: [{id: "m-1",role: "user",parts: [{type: "text",text: "hi"}]}],
-chatId: CHAT_ID,
-sessionId: SESSION_ID,
-};
-
-functionmakeRequest(body: unknown=validBody): NextRequest{
+functionmakeRequest(): NextRequest{
 returnnewNextRequest("http://localhost/api/chat/workflow",{
 method: "POST",
 headers: {"x-api-key": "test-key","content-type": "application/json"},
-body: typeofbody==="string" ? body : JSON.stringify(body),
+body: JSON.stringify({messages: [],chatId: CHAT_ID,sessionId: SESSION_ID}),
 });
 }
 
-functionmockOwnedSessionWithActiveSandbox(){
-vi.mocked(validateAuthContext).mockResolvedValue({
-accountId: ACCOUNT_ID,
+functionmockValidatedRequest(overrides: Partial<{accountId: string}>={}){
+vi.mocked(validateChatWorkflow).mockResolvedValue({
+messages: [],
+chatId: CHAT_ID,
+sessionId: SESSION_ID,
+accountId: overrides.accountId??ACCOUNT_ID,
 orgId: null,
 authToken: "test-key",
 });
+}
+
+functionmockOwnedSessionWithActiveSandbox(){
+mockValidatedRequest();
 vi.mocked(selectSessions).mockResolvedValue([
 {id: SESSION_ID,account_id: ACCOUNT_ID,sandbox_state: {ready: true}}asnever,
 ]);
@@ -61,54 +61,30 @@ describe("handleChatWorkflowStream (stub)", () => {
 vi.clearAllMocks();
 });
 
-describe("auth",()=>{
-it("returns 401 short-circuit from validateAuthContext",async()=>{
+describe("validation short-circuits",()=>{
+it("returns the validator's short-circuit response unchanged (e.g. 401)",async()=>{
 constauthError=NextResponse.json(
 {status: "error",error: "Unauthorized"},
 {status: 401},
 );
-vi.mocked(validateAuthContext).mockResolvedValue(authError);
+vi.mocked(validateChatWorkflow).mockResolvedValue(authError);
 constres=awaithandleChatWorkflowStream(makeRequest());
 expect(res.status).toBe(401);
 });
-});
 
-describe("body validation",()=>{
-it("returns 400 on invalid JSON body",async()=>{
-vi.mocked(validateAuthContext).mockResolvedValue({
-accountId: ACCOUNT_ID,
-orgId: null,
-authToken: "k",
-});
-constreq=newNextRequest("http://localhost/api/chat/workflow",{
-method: "POST",
-headers: {"x-api-key": "test-key","content-type": "application/json"},
-body: "{not-json",
-});
-constres=awaithandleChatWorkflowStream(req);
-expect(res.status).toBe(400);
-});
-
-it("returns 400 when chatId is missing",async()=>{
-vi.mocked(validateAuthContext).mockResolvedValue({
-accountId: ACCOUNT_ID,
-orgId: null,
-authToken: "k",
-});
-const{chatId: _omit, ...rest}=validBody;
-constres=awaithandleChatWorkflowStream(makeRequest(rest));
+it("returns the validator's 400 unchanged (e.g. invalid body)",async()=>{
+constbadBody=NextResponse.json(
+{status: "error",error: "Invalid JSON body"},
+{status: 400},
+);
+vi.mocked(validateChatWorkflow).mockResolvedValue(badBody);
+constres=awaithandleChatWorkflowStream(makeRequest());
 expect(res.status).toBe(400);
 });
 });
 
 describe("session / chat ownership",()=>{
-beforeEach(()=>{
-vi.mocked(validateAuthContext).mockResolvedValue({
-accountId: ACCOUNT_ID,
-orgId: null,
-authToken: "k",
-});
-});
+beforeEach(()=>mockValidatedRequest());
 
 it("returns 404 when the session does not exist",async()=>{
 vi.mocked(selectSessions).mockResolvedValue([]);

lib/chat/__tests__/validateChatWorkflow.test.ts

@@ -0,0 +1,142 @@
+import{describe,it,expect,vi,beforeEach}from"vitest";
+import{NextRequest,NextResponse}from"next/server";
+
+import{validateChatWorkflow}from"@/lib/chat/validateChatWorkflow";
+import{validateAuthContext}from"@/lib/auth/validateAuthContext";
+
+vi.mock("@/lib/auth/validateAuthContext",()=>({
+validateAuthContext: vi.fn(),
+}));
+
+constACCOUNT_ID="aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa";
+constCHAT_ID="11111111-1111-1111-1111-111111111111";
+constSESSION_ID="22222222-2222-2222-2222-222222222222";
+
+constvalidBody={
+messages: [{id: "m-1",role: "user",parts: [{type: "text",text: "hi"}]}],
+chatId: CHAT_ID,
+sessionId: SESSION_ID,
+};
+
+functionmakeRequest(body: unknown=validBody): NextRequest{
+returnnewNextRequest("http://localhost/api/chat/workflow",{
+method: "POST",
+headers: {"x-api-key": "k","content-type": "application/json"},
+body: typeofbody==="string" ? body : JSON.stringify(body),
+});
+}
+
+functionmockAuthOk(){
+vi.mocked(validateAuthContext).mockResolvedValue({
+accountId: ACCOUNT_ID,
+orgId: null,
+authToken: "k",
+});
+}
+
+describe("validateChatWorkflow",()=>{
+beforeEach(()=>vi.clearAllMocks());
+
+describe("valid input",()=>{
+beforeEach(()=>mockAuthOk());
+
+it("returns the validated body augmented with accountId / orgId / authToken",async()=>{
+constresult=awaitvalidateChatWorkflow(makeRequest());
+expect(result).not.toBeInstanceOf(NextResponse);
+if(resultinstanceofNextResponse)return;
+expect(result.chatId).toBe(CHAT_ID);
+expect(result.sessionId).toBe(SESSION_ID);
+expect(result.messages).toEqual(validBody.messages);
+expect(result.accountId).toBe(ACCOUNT_ID);
+expect(result.orgId).toBe(null);
+expect(result.authToken).toBe("k");
+});
+
+it("accepts an optional context.contextLimit integer",async()=>{
+constresult=awaitvalidateChatWorkflow(
+makeRequest({ ...validBody,context: {contextLimit: 50}}),
+);
+expect(result).not.toBeInstanceOf(NextResponse);
+if(resultinstanceofNextResponse)return;
+expect(result.context?.contextLimit).toBe(50);
+});
+
+it("accepts an empty messages array",async()=>{
+constresult=awaitvalidateChatWorkflow(makeRequest({ ...validBody,messages: []}));
+expect(result).not.toBeInstanceOf(NextResponse);
+});
+});
+
+describe("invalid body",()=>{
+it("returns 400 when JSON is malformed",async()=>{
+constreq=newNextRequest("http://localhost/api/chat/workflow",{
+method: "POST",
+headers: {"x-api-key": "k","content-type": "application/json"},
+body: "{not-json",
+});
+constresult=awaitvalidateChatWorkflow(req);
+expect(result).toBeInstanceOf(NextResponse);
+if(!(resultinstanceofNextResponse))return;
+expect(result.status).toBe(400);
+});
+
+it("returns 400 when chatId is missing",async()=>{
+const{chatId: _omit, ...rest}=validBody;
+constresult=awaitvalidateChatWorkflow(makeRequest(rest));
+expect(result).toBeInstanceOf(NextResponse);
+if(!(resultinstanceofNextResponse))return;
+expect(result.status).toBe(400);
+});
+
+it("returns 400 when sessionId is missing",async()=>{
+const{sessionId: _omit, ...rest}=validBody;
+constresult=awaitvalidateChatWorkflow(makeRequest(rest));
+expect(result).toBeInstanceOf(NextResponse);
+if(!(resultinstanceofNextResponse))return;
+expect(result.status).toBe(400);
+});
+
+it("returns 400 when messages is not an array",async()=>{
+constresult=awaitvalidateChatWorkflow(makeRequest({ ...validBody,messages: "nope"}));
+expect(result).toBeInstanceOf(NextResponse);
+if(!(resultinstanceofNextResponse))return;
+expect(result.status).toBe(400);
+});
+
+it("returns 400 when chatId is empty string",async()=>{
+constresult=awaitvalidateChatWorkflow(makeRequest({ ...validBody,chatId: ""}));
+expect(result).toBeInstanceOf(NextResponse);
+if(!(resultinstanceofNextResponse))return;
+expect(result.status).toBe(400);
+});
+
+it("returns 400 when context.contextLimit is not an integer",async()=>{
+constresult=awaitvalidateChatWorkflow(
+makeRequest({ ...validBody,context: {contextLimit: "fifty"}}),
+);
+expect(result).toBeInstanceOf(NextResponse);
+if(!(resultinstanceofNextResponse))return;
+expect(result.status).toBe(400);
+});
+
+it("does not call validateAuthContext when body validation fails",async()=>{
+const{chatId: _omit, ...rest}=validBody;
+awaitvalidateChatWorkflow(makeRequest(rest));
+expect(validateAuthContext).not.toHaveBeenCalled();
+});
+});
+
+describe("auth",()=>{
+it("returns the auth short-circuit response when validateAuthContext rejects",async()=>{
+constauthError=NextResponse.json(
+{status: "error",error: "Unauthorized"},
+{status: 401},
+);
+vi.mocked(validateAuthContext).mockResolvedValue(authError);
+constresult=awaitvalidateChatWorkflow(makeRequest());
+expect(result).toBeInstanceOf(NextResponse);
+if(!(resultinstanceofNextResponse))return;
+expect(result.status).toBe(401);
+});
+});
+});