ts/validate-untrusted

Dlaczego

Types are erased at build time. (await res.json()) as User does not check anything: when the API renames a field or returns an error object, the code reads undefined deep inside a component, far from the cause. The cast also tells the reader the data was checked when it was not.

Poprawka

Treat the value as unknown and validate it once where it enters: a schema (Valibot, Zod Mini, or the validator the project already uses) that returns typed data or throws, or a hand-written type guard for a small shape. Pass the checked value inward; inner code then needs no casts.

Przykłady

// bad
const user = (await res.json()) as User
const settings: Settings = JSON.parse(localStorage.getItem('settings') ?? '{}')
// good
const user = v.parse(UserSchema, await res.json())
const settings = v.parse(SettingsSchema, JSON.parse(localStorage.getItem('settings') ?? '{}'))

Źródła

• TypeScript handbook, More on functions (unknown, the JSON.parse example)
• TypeScript handbook, Narrowing

Przeczytaj w terminalu

npx github:dawidolko/frontend-skills explain ts/validate-untrusted