fix(capi): share value and currency rules and reject oversized values

Author: viethungpv91

packages/business/src/meta-conversions/schema.ts

@@ -14,34 +14,15 @@ import {
   defaultMetaCapiActionSource,
   metaCapiActionSourceSchema,
   metaCapiContentTypeSchema,
+  metaCapiCurrencySchema,
   metaCapiEventNameSchema,
+  metaCapiValueSchema,
 } from "@chatbotx.io/utils/meta-capi"
 import { z } from "zod"
 import { splitContentIds } from "./event-input"
 
 const capiDatasetIdSchema = z.string().trim().regex(/^\d+$/)
 const capiAccessTokenSchema = z.string().trim().min(1)
-// Value must already be canonical `\d+(\.\d+)?` after `trim()` — no
-// destructive normalization (no comma/dot stripping: "12,50" is ambiguous
-// between 12.50 and 1250). An unresolved `{{...}}` template that leaked past
-// the worker's variable resolution is rejected here, not persisted.
-const capiEventValueSchema = z
-  .string()
-  .trim()
-  .regex(/^\d+(\.\d+)?$/, "Value must be a plain number such as 19.99")
-const capiEventCurrencySchema = z
-  .string()
-  .trim()
-  .toUpperCase()
-  .pipe(
-    z
-      .string()
-      .regex(
-        /^[A-Z]{3}$/,
-        "Currency must be a 3-letter ISO 4217 code such as USD",
-      ),
-  )
-
 /**
  * Business-boundary input for enqueuing a Meta CAPI event, shared by the
  * flow-step handler and the trigger executor — both resolve any
@@ -69,8 +50,8 @@ export const enqueueEventInput = withMetaCapiEventRefinements(
       splitContentIds,
       z.array(z.string().min(1)).min(1).optional(),
     ),
-    value: capiEventValueSchema.optional(),
-    currency: capiEventCurrencySchema.optional(),
+    value: metaCapiValueSchema.optional(),
+    currency: metaCapiCurrencySchema.optional(),
     contentCategory: z.string().trim().min(1).max(200).optional(),
     contentName: z.string().trim().min(1).max(200).optional(),
     occurredAt: z.date().optional(),

packages/flow-config/src/steps/send-meta-capi-event.ts

@@ -7,7 +7,9 @@ import {
   metaCapiActionSourceSchema,
   metaCapiBusinessMessagingEventNames,
   metaCapiContentTypeSchema,
+  metaCapiCurrencySchema,
   metaCapiEventNameSchema,
+  metaCapiValueSchema,
 } from "@chatbotx.io/utils/meta-capi"
 import { containsVariablePlaceholder } from "@chatbotx.io/utils/variables"
 import { z } from "zod"
@@ -50,17 +52,6 @@ export const templateOrStatic = <TOutput>(
     return z.NEVER
   })
 
-const metaCapiValueStaticSchema = z
-  .string()
-  .trim()
-  .regex(/^\d+(\.\d+)?$/)
-
-const metaCapiCurrencyStaticSchema = z
-  .string()
-  .trim()
-  .toUpperCase()
-  .pipe(z.string().regex(/^[A-Z]{3}$/))
-
 const metaCapiContentIdsStaticSchema = z.string().trim().min(1)
 
 /**
@@ -72,10 +63,10 @@ const optionalTemplateOrStatic = <TOutput>(
   staticSchema: z.ZodType<TOutput, string>,
 ) => z.preprocess(blankToUndefined, templateOrStatic(staticSchema).optional())
 
-const metaCapiValueSchema = optionalTemplateOrStatic(metaCapiValueStaticSchema)
+const metaCapiValueFieldSchema = optionalTemplateOrStatic(metaCapiValueSchema)
 
-const metaCapiCurrencySchema = optionalTemplateOrStatic(
-  metaCapiCurrencyStaticSchema,
+const metaCapiCurrencyFieldSchema = optionalTemplateOrStatic(
+  metaCapiCurrencySchema,
 )
 
 // Comma-separated Meta `content_ids` (e.g. "123,456" or "{{a}},{{b}}"); split
@@ -198,8 +189,8 @@ export const metaCapiEventFieldsSchema = z.object({
   actionSource: metaCapiActionSourceSchema.default(defaultMetaCapiActionSource),
   contentType: metaCapiContentTypeSchema.optional(),
   contentIds: metaCapiContentIdsSchema,
-  value: metaCapiValueSchema,
-  currency: metaCapiCurrencySchema,
+  value: metaCapiValueFieldSchema,
+  currency: metaCapiCurrencyFieldSchema,
   contentCategory: metaCapiContentTextSchema,
   contentName: metaCapiContentTextSchema,
 })

packages/utils/__tests__/meta-capi.test.ts

@@ -5,7 +5,9 @@ import {
   metaCapiActionSourceValues,
   metaCapiBusinessMessagingEventNames,
   metaCapiContentTypeValues,
+  metaCapiCurrencySchema,
   metaCapiEventNameSchema,
+  metaCapiValueSchema,
   metaPixelStandardEventNames,
 } from "../src/meta-capi"
 
@@ -70,3 +72,40 @@ describe("metaCapiContentTypeValues", () => {
     expect(metaCapiContentTypeValues).toEqual(["product", "product_group"])
   })
 })
+
+describe("metaCapiValueSchema / metaCapiCurrencySchema", () => {
+  test.each([
+    "19.99",
+    " 250 ",
+    "0",
+    "9007199254740991",
+  ])("accepts plain decimal %j", (input) => {
+    expect(metaCapiValueSchema.safeParse(input).success).toBe(true)
+  })
+
+  test.each([
+    "12,50",
+    "1e5",
+    "-5",
+    "abc",
+    "{{amount}}",
+    "",
+    "1.",
+    ".5",
+  ])("rejects non-canonical value %j", (input) => {
+    expect(metaCapiValueSchema.safeParse(input).success).toBe(false)
+  })
+
+  test("rejects a value that would not survive Number() intact", () => {
+    expect(metaCapiValueSchema.safeParse("9007199254740992").success).toBe(
+      false,
+    )
+    expect(metaCapiValueSchema.safeParse("1".repeat(400)).success).toBe(false)
+  })
+
+  test("currency is upper-cased and must be a 3-letter code", () => {
+    expect(metaCapiCurrencySchema.parse(" usd ")).toBe("USD")
+    expect(metaCapiCurrencySchema.safeParse("US").success).toBe(false)
+    expect(metaCapiCurrencySchema.safeParse("USDT").success).toBe(false)
+  })
+})

packages/utils/src/meta-capi.ts

@@ -156,6 +156,38 @@ export type MetaCapiActionSource = z.infer<typeof metaCapiActionSourceSchema>
 export const defaultMetaCapiActionSource: MetaCapiActionSource =
   "business_messaging"
 
+const PLAIN_DECIMAL_PATTERN = /^\d+(\.\d+)?$/
+const ISO_4217_PATTERN = /^[A-Z]{3}$/
+
+/**
+ * Meta CAPI `custom_data.value`: a canonical plain decimal, already trimmed,
+ * with no locale normalisation ("12,50" is ambiguous between 12.50 and 1250)
+ * and small enough to survive `Number()` exactly — a digit string long
+ * enough to overflow to `Infinity` would otherwise serialise as `null`.
+ */
+export const metaCapiValueSchema = z
+  .string()
+  .trim()
+  .regex(PLAIN_DECIMAL_PATTERN, "Value must be a plain number such as 19.99")
+  .refine(
+    (value) => Number(value) <= Number.MAX_SAFE_INTEGER,
+    "Value is too large",
+  )
+
+/** Meta CAPI `custom_data.currency`: a 3-letter ISO 4217 code, upper-cased. */
+export const metaCapiCurrencySchema = z
+  .string()
+  .trim()
+  .toUpperCase()
+  .pipe(
+    z
+      .string()
+      .regex(
+        ISO_4217_PATTERN,
+        "Currency must be a 3-letter ISO 4217 code such as USD",
+      ),
+  )
+
 /**
  * Meta CAPI `custom_data.content_type` values
  * (https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/custom-data).