Make api endpoints type safe at runtime

[pmarsh-scottlogic]

Since Typescript only operates at compile time, and our endpoints receive arbitrary JSON at runtime, a client could pass in JSON with all the wrong types and our code will happily consume it. Take handleAddToChatHistory as an example.

function handleAddToChatHistory(req: OpenAiAddHistoryRequest, res: Response) {
	const infoMessage = req.body.message;
	const chatMessageType = req.body.chatMessageType;
	const level = req.body.level;
	if (
		infoMessage &&
		chatMessageType &&
		level !== undefined &&
		level >= LEVEL_NAMES.LEVEL_1
	) {
		req.session.levelState[level].chatHistory = pushMessageToHistory(
			req.session.levelState[level].chatHistory,
			{
				chatMessageType,
				infoMessage,
			} as ChatMessage
		);
		res.send();
	} else {
		res.status(400);
		res.send();
	}
}

where

type OpenAiAddHistoryRequest = Request<
	never,
	never,
	{
		chatMessageType?: CHAT_MESSAGE_TYPE;
		message?: string;
		level?: LEVEL_NAMES;
	},
	never,
	never
>;

At the moment we check that stuff exists, but we don't check the type. Here's a nonsense request body that would be happily consumed at runtime (resulting in a 500 error):

{
    "level": 1000,
    "message": true,
    "chatMessageType": "hello!"
}