fix(api): validate push and domain verification targets (#2346)

packages/schema/src/domains/connection/ConnectionSchemas.ts

@@ -11,6 +11,7 @@ import {
 	Int32Type,
 	withOpenApiType,
 } from '@fluxer/schema/src/primitives/SchemaPrimitives';
+import {HostnameType} from '@fluxer/schema/src/primitives/UrlValidators';
 import {z} from 'zod';
 
 const ConnectionTypeSchema = withOpenApiType(
@@ -62,7 +63,7 @@ export type VerifyAndCreateConnectionRequest = z.infer<typeof VerifyAndCreateCon
 
 export const CreateConnectionRequest = z.object({
 	type: ConnectionTypeSchema.describe('The type of connection to create'),
-	identifier: z.string().min(1).max(253).describe('The connection identifier (handle or domain)'),
+	identifier: HostnameType.describe('The connection identifier (handle or domain)'),
 	visibility_flags: Int32Type.optional().describe('Bitfield controlling who can see this connection'),
 });
 

packages/schema/src/domains/user/UserRequestSchemas.ts

@@ -514,6 +514,13 @@ export const RegisterMobileDeviceRequest = z
 	})
 	.superRefine((value, ctx) => {
 		if (value.platform !== 'android_unified_push') return;
+		if (!URLType.safeParse(value.token).success) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ['token'],
+				message: 'UnifiedPush registrations require a valid endpoint URL',
+			});
+		}
 		if (!value.encryption_key) {
 			ctx.addIssue({
 				code: z.ZodIssueCode.custom,