fix(api): Zod-contract storage-status and ratchet validation baseline

Wire /api/files/storage-status through a shared route contract so the
strict API validation audit stays at zero non-Zod routes after the new
Instagram cloud-storage check.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

apps/sim/app/api/files/storage-status/route.ts

@@ -1,4 +1,6 @@
-import { NextResponse } from 'next/server'
+import { type NextRequest, NextResponse } from 'next/server'
+import { fileStorageStatusContract } from '@/lib/api/contracts/storage-transfer'
+import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { hasCloudStorage } from '@/lib/uploads/core/storage-service'
@@ -9,11 +11,14 @@ export const dynamic = 'force-dynamic'
  * GET /api/files/storage-status
  * Whether S3 or Azure Blob is configured (needed for Instagram file-upload publish).
  */
-export const GET = withRouteHandler(async () => {
+export const GET = withRouteHandler(async (request: NextRequest) => {
   const session = await getSession()
   if (!session?.user?.id) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const parsed = await parseRequest(fileStorageStatusContract, request, {})
+  if (!parsed.success) return parsed.response
+
   return NextResponse.json({ cloudConfigured: hasCloudStorage() })
 })

apps/sim/hooks/queries/workspace-files.ts

@@ -6,6 +6,7 @@ import { backoffWithJitter } from '@sim/utils/retry'
 import { keepPreviousData, useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { ApiClientError, isApiClientError } from '@/lib/api/client/errors'
 import { requestJson } from '@/lib/api/client/request'
+import { fileStorageStatusContract } from '@/lib/api/contracts/storage-transfer'
 import { getUsageLimitsContract } from '@/lib/api/contracts/usage-limits'
 import {
   deleteWorkspaceFileContract,
@@ -298,12 +299,7 @@ export function useStorageInfo(enabled = true) {
 }
 
 async function fetchCloudStorageConfigured(signal?: AbortSignal): Promise<boolean> {
-  // boundary-raw-fetch: tiny status endpoint, no shared contract yet
-  const response = await fetch('/api/files/storage-status', { signal, cache: 'no-store' })
-  if (!response.ok) {
-    throw new Error('Failed to check cloud storage status')
-  }
-  const data = (await response.json()) as { cloudConfigured?: boolean }
+  const data = await requestJson(fileStorageStatusContract, { signal })
   return data.cloudConfigured === true
 }
 

apps/sim/lib/api/contracts/storage-transfer.ts

@@ -745,6 +745,18 @@ export const fileExportContract = defineRouteContract({
   response: { mode: 'binary' },
 })
 
+export const fileStorageStatusResponseSchema = z.object({
+  cloudConfigured: z.boolean(),
+})
+
+export const fileStorageStatusContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/files/storage-status',
+  response: { mode: 'json', schema: fileStorageStatusResponseSchema },
+})
+
+export type FileStorageStatusResponse = ContractJsonResponse<typeof fileStorageStatusContract>
+
 export type BoxUploadBody = ContractBodyInput<typeof boxUploadContract>
 export type BoxUploadResponse = ContractJsonResponse<typeof boxUploadContract>
 export type DropboxUploadBody = ContractBodyInput<typeof dropboxUploadContract>

scripts/check-api-validation-contracts.ts

@@ -9,8 +9,8 @@ const QUERY_HOOKS_DIR = path.join(ROOT, 'apps/sim/hooks/queries')
 const SELECTOR_HOOKS_DIR = path.join(ROOT, 'apps/sim/hooks/selectors')
 
 const BASELINE = {
-  totalRoutes: 927,
-  zodRoutes: 927,
+  totalRoutes: 935,
+  zodRoutes: 935,
   nonZodRoutes: 0,
 } as const
 
@@ -25,7 +25,7 @@ const BOUNDARY_POLICY_BASELINE = {
   clientHookRawFetches: 0,
   clientSameOriginApiFetches: 0,
   doubleCasts: 8,
-  rawJsonReads: 8,
+  rawJsonReads: 6,
   untypedResponses: 0,
   annotationsMissingReason: 0,
 } as const