Parsing defensif dan amplop galat

export type ErrorEnvelope = { error: string; code?: string; details?: unknown }

export function toEnvelope(u: unknown): ErrorEnvelope {
  if (u instanceof Error) return { error: u.message }
  if (typeof u === "string") return { error: u }
  try { return { error: JSON.stringify(u) } } catch { return { error: "Unknown error" } }
}

import { z, type ZodTypeAny } from "zod"

export function validate<T extends ZodTypeAny>(schema: T, value: unknown) {
  const r = schema.safeParse(value)
  if (!r.success) {
    return { ok: false as const, issues: r.error.format() }
  }
  return { ok: true as const, data: r.data as z.infer<T> }
}

import type { Request, Response, NextFunction } from "express"
import { z } from "zod"
import { validate } from "./validate"
import { toEnvelope, type ErrorEnvelope } from "./envelope"

const bodySchema = z.object({ email: z.string().email(), newsletter: z.boolean().default(false) })

export function subscribe(req: Request, res: Response<{ ok: true } | ErrorEnvelope>, next: NextFunction) {
  const r = validate(bodySchema, req.body)
  if (!r.ok) return res.status(400).json({ error: "Invalid body", details: r.issues })
  try {
    // pretend to persist
    return res.status(201).json({ ok: true })
  } catch (e) {
    return next(e)
  }
}

export function errorMiddleware(err: unknown, _req: Request, res: Response<ErrorEnvelope>, _next: NextFunction) {
  const env = toEnvelope(err)
  res.status(500).json(env)
}

export function notFound(resource: string): { status: 404; body: { error: string; code: string } } {
  return { status: 404, body: { error: `${resource} not found`, code: "NOT_FOUND" } }
}

export function unauthorized(): { status: 401; body: { error: string; code: string } } {
  return { status: 401, body: { error: "unauthorized", code: "UNAUTHORIZED" } }
}