Add request/response schema validation for all public backend APIs

[grantfox-oss]

Some controllers allow malformed payloads or return undocumented response shapes, which weakens client contracts and allows runtime mismatches between frontend, mobile, and backend.

Affected areas: app/backend/src/common/validation.pipe.ts, app/backend/src/*.controller.ts, app/backend/src/contracts/*, app/backend/src/refunds/*, app/backend/src/payments/*, OpenAPI docs/tests.

Implementation scope:

• Add request validation for all public API DTOs and transform untrusted payloads consistently.
• Add response validation or output DTO enforcement for top-level controllers.
• Sync OpenAPI schemas with runtime DTOs and generate snapshot tests.
• Validate pagination, cursor shapes, and contract event payloads.

Acceptance criteria:

• Invalid requests receive a consistent 400 error with a stable schema.
• Controller responses match documented OpenAPI types.
• Tests fail if response shape drifts from the API contract.

[Chigybillionz]

Hello maintainer

I would like to work on this issue.

Experience:
I have experience with NestJS, TypeScript, DTO validation, OpenAPI/Swagger documentation, API contract enforcement, and automated testing. I have worked on building strongly typed backend systems where request and response contracts remain synchronized across frontend, mobile, and backend services.

Implementation:
I will enforce validation across all public API DTOs using consistent transformation and validation rules, introduce output DTO enforcement for controller responses, align OpenAPI schemas with runtime DTO definitions, and add snapshot tests to detect contract drift. I will also validate pagination, cursor formats, and contract event payloads to ensure API behavior remains predictable and well-documented.

Delivery:
I can complete the implementation, testing, documentation updates, and submit a clean PR within 6–8 hours, ensuring invalid payloads receive consistent 400 responses, response shapes match documented contracts, and future API drift is automatically caught by tests.

GitHub:
https://github.com/chigybillionz

[Kureszn]

I've reviewed the issue and believe I can contribute effectively. My experience spans software development, blockchain technologies, cybersecurity and open source collaboration. I take a structured approach to contributions carefully understanding the existing codebase, identifying the root cause and delivering a thoroughly tested implementation.

[mxrtins04]

I've looked at the scope. The work is tightening the validation pipe for all public DTOs, adding output enforcement on the affected controllers, syncing OpenAPI schemas with runtime types, and adding snapshot tests that catch contract drift. This is light work for me, I can handle this within 3 hours.

[ALLEN-AYODEJI]

Hey Boss!!
I am a Fullstack Developer and i would really love to solve this issue!

[jesutobaadedejidev]

I can work on this. Do assign this to me

[Chrisbankz0]

Hello, I’m a full stack developer with hands-on experience building with variety of tools including Nextjs, nodejs, nestjs, React, Typescript and more

I focus on writing clear, maintainable code and making sure features work as expected end to end, not just in isolation. I communicate progress regularly and keep things transparent as I work. I’m confident I can complete this task within an ETA of 4 HOURS

[Menjay7]

Hi! I came across this issue and would love to work on it. I have experience with similar tasks and I'm confident I can investigate, implement a clean solution, and thoroughly test it before submitting a PR. If the issue is still open, I would appreciate it if you could assign it to me. Thank you!

[grantfox-oss]

🦊 GrantFox — @Chrisbankz0 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #26)
2. Your PR will be reviewed by the BlockDash-Studios maintainers

Good luck! Track your progress on GrantFox.