Validate API request query (#4642)

* fix: refactor to accommodate authentication, transaction and pagination together into ctx.state

* feat: allow passing response type to APIContext

* feat: preliminary work for initial review

* fix: use unknown for base types

* fix: api/attachments

* fix: api/documents

* fix: jsdoc comment for input

* fix: replace at() with index access for compatibility

* fix: validation err message

* fix: error handling

* fix: remove unnecessary extend

server/types.ts

@@ -1,7 +1,9 @@
 import { ParameterizedContext, DefaultContext } from "koa";
 import { IRouterParamContext } from "koa-router";
 import { Transaction } from "sequelize/types";
+import { z } from "zod";
 import { Client } from "@shared/types";
+import BaseSchema from "@server/routes/api/BaseSchema";
 import { AccountProvisionerResult } from "./commands/accountProvisioner";
 import { FileOperation, Team, User } from "./models";
 
@@ -34,12 +36,17 @@ export type AppState = {
 
 export type AppContext = ParameterizedContext<AppState, DefaultContext>;
 
-export interface APIContext<ReqT = Record<string, unknown>, ResT = unknown>
+export type BaseReq = z.infer<typeof BaseSchema>;
+
+export type BaseRes = unknown;
+
+export interface APIContext<ReqT = BaseReq, ResT = BaseRes>
   extends ParameterizedContext<
     AppState,
     DefaultContext & IRouterParamContext<AppState>,
     ResT
   > {
+  /** Typed and validated version of request, consisting of validated body, query, etc */
   input: ReqT;
 }