From b101725396ed568666dcbae99a480db793cd20d1 Mon Sep 17 00:00:00 2001
From: Zakaria El Asri <33696020+zakariaelas@users.noreply.github.com>
Date: Thu, 5 Aug 2021 15:36:14 +0100
Subject: [PATCH] fix: product and variant api route validation (#331)

---
 .../routes/admin/products/create-product.js   | 32 +++++++++++++-----
 .../routes/admin/products/create-variant.js   | 18 +++++++---
 .../routes/admin/products/update-product.js   | 33 ++++++++++++++-----
 .../routes/admin/products/update-variant.js   | 18 +++++++---
 4 files changed, 75 insertions(+), 26 deletions(-)

diff --git a/packages/medusa/src/api/routes/admin/products/create-product.js b/packages/medusa/src/api/routes/admin/products/create-product.js
index 57d5024394..0d9b928691 100644
--- a/packages/medusa/src/api/routes/admin/products/create-product.js
+++ b/packages/medusa/src/api/routes/admin/products/create-product.js
@@ -222,10 +222,18 @@ export default async (req, res) => {
       inventory_quantity: Validator.number().default(0),
       allow_backorder: Validator.boolean().optional(),
       manage_inventory: Validator.boolean().optional(),
-      weight: Validator.number().optional(),
-      length: Validator.number().optional(),
-      height: Validator.number().optional(),
-      width: Validator.number().optional(),
+      weight: Validator.number()
+        .allow(null)
+        .optional(),
+      length: Validator.number()
+        .allow(null)
+        .optional(),
+      height: Validator.number()
+        .allow(null)
+        .optional(),
+      width: Validator.number()
+        .allow(null)
+        .optional(),
       origin_country: Validator.string()
         .optional()
         .allow("")
@@ -259,10 +267,18 @@ export default async (req, res) => {
         })
         .default([]),
     }),
-    weight: Validator.number().optional(),
-    length: Validator.number().optional(),
-    height: Validator.number().optional(),
-    width: Validator.number().optional(),
+    weight: Validator.number()
+      .allow(null)
+      .optional(),
+    length: Validator.number()
+      .allow(null)
+      .optional(),
+    height: Validator.number()
+      .allow(null)
+      .optional(),
+    width: Validator.number()
+      .allow(null)
+      .optional(),
     hs_code: Validator.string()
       .optional()
       .allow(""),
diff --git a/packages/medusa/src/api/routes/admin/products/create-variant.js b/packages/medusa/src/api/routes/admin/products/create-variant.js
index 804f40ac7d..a45722cd0c 100644
--- a/packages/medusa/src/api/routes/admin/products/create-variant.js
+++ b/packages/medusa/src/api/routes/admin/products/create-variant.js
@@ -115,10 +115,18 @@ export default async (req, res) => {
     inventory_quantity: Validator.number().default(0),
     allow_backorder: Validator.boolean().optional(),
     manage_inventory: Validator.boolean().optional(),
-    weight: Validator.number().optional(),
-    length: Validator.number().optional(),
-    height: Validator.number().optional(),
-    width: Validator.number().optional(),
+    weight: Validator.number()
+      .allow(null)
+      .optional(),
+    length: Validator.number()
+      .allow(null)
+      .optional(),
+    height: Validator.number()
+      .allow(null)
+      .optional(),
+    width: Validator.number()
+      .allow(null)
+      .optional(),
     origin_country: Validator.string().allow(""),
     mid_code: Validator.string().allow(""),
     material: Validator.string().allow(""),
@@ -127,7 +135,7 @@ export default async (req, res) => {
       .items(
         Validator.object()
           .keys({
-            region_id: Validator.string(),
+            region_id: Validator.string().empty(null),
             currency_code: Validator.string().required(),
             amount: Validator.number()
               .integer()
diff --git a/packages/medusa/src/api/routes/admin/products/update-product.js b/packages/medusa/src/api/routes/admin/products/update-product.js
index 50695cb28e..f11982f3e1 100644
--- a/packages/medusa/src/api/routes/admin/products/update-product.js
+++ b/packages/medusa/src/api/routes/admin/products/update-product.js
@@ -210,11 +210,20 @@ export default async (req, res) => {
       })
       .optional(),
     handle: Validator.string().optional(),
-    weight: Validator.number().optional(),
-    length: Validator.number().optional(),
-    height: Validator.number().optional(),
-    width: Validator.number().optional(),
+    weight: Validator.number()
+      .allow(null)
+      .optional(),
+    length: Validator.number()
+      .allow(null)
+      .optional(),
+    height: Validator.number()
+      .allow(null)
+      .optional(),
+    width: Validator.number()
+      .allow(null)
+      .optional(),
     origin_country: Validator.string().allow(null, ""),
+    hs_code: Validator.string().allow(null, ""),
     mid_code: Validator.string().allow(null, ""),
     material: Validator.string().allow(null, ""),
     images: Validator.array()
@@ -250,10 +259,18 @@ export default async (req, res) => {
         inventory_quantity: Validator.number().allow(null),
         allow_backorder: Validator.boolean().allow(null),
         manage_inventory: Validator.boolean().allow(null),
-        weight: Validator.number().optional(),
-        length: Validator.number().optional(),
-        height: Validator.number().optional(),
-        width: Validator.number().optional(),
+        weight: Validator.number()
+          .allow(null)
+          .optional(),
+        length: Validator.number()
+          .allow(null)
+          .optional(),
+        height: Validator.number()
+          .allow(null)
+          .optional(),
+        width: Validator.number()
+          .allow(null)
+          .optional(),
         hs_code: Validator.string()
           .optional()
           .allow(null, ""),
diff --git a/packages/medusa/src/api/routes/admin/products/update-variant.js b/packages/medusa/src/api/routes/admin/products/update-variant.js
index d7973a6e73..1782ab17be 100644
--- a/packages/medusa/src/api/routes/admin/products/update-variant.js
+++ b/packages/medusa/src/api/routes/admin/products/update-variant.js
@@ -114,7 +114,7 @@ export default async (req, res) => {
     prices: Validator.array().items(
       Validator.object()
         .keys({
-          region_id: Validator.string(),
+          region_id: Validator.string().empty(null),
           currency_code: Validator.string(),
           amount: Validator.number()
             .integer()
@@ -133,10 +133,18 @@ export default async (req, res) => {
     inventory_quantity: Validator.number().optional(),
     allow_backorder: Validator.boolean().optional(),
     manage_inventory: Validator.boolean().optional(),
-    weight: Validator.number().optional(),
-    length: Validator.number().optional(),
-    height: Validator.number().optional(),
-    width: Validator.number().optional(),
+    weight: Validator.number()
+      .allow(null)
+      .optional(),
+    length: Validator.number()
+      .allow(null)
+      .optional(),
+    height: Validator.number()
+      .allow(null)
+      .optional(),
+    width: Validator.number()
+      .allow(null)
+      .optional(),
     hs_code: Validator.string()
       .optional()
       .allow(null, ""),