Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

2.0: Standard Schema validation for query/action input

Open
  • Is something wrong?
#569 3 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Quiet
Tech stack
typescript
Domain
api, backend-api-design

Research direction

Start by reading the actionable context in #507 and its linked server-function constraint discussion, then review the existing query and action APIs alongside the Standard Schema contract. The open questions about overload shape, multi-argument functions, validation failures, and direct server-side calls must be resolved before implementation is complete.

Written by the indexing model from the issue text.

Description

enhancement

Tracking the actionable part of #507 as a 2.0 improvement.

Problem

"use server" functions type their arguments as written (e.g. email: string), but the input actually crosses a serialization boundary and is attacker-controlled. Typing it honestly as unknown destroys caller-side DX. Users want "typed on the outside, validated on the inside."

Userland wrappers can't solve this: composing a validator around a "use server" function runs into server-function compilation constraints (Server Functions cannot be nested in other blocks or functions - see https://github.com/solidjs/solid-router/issues/507#issuecomment-2694797871), so first-class router support is the only clean path.

Proposal

Accept an optional Standard Schema validator in query and action:

const getUser = query(z.string().email(), async (email) => {
  "use server";
  // email: string, already validated at the boundary
}, "get-user");
  • Caller-side argument types derive from the schema's input type.
  • The function body receives the schema's output type, validated server-side before the body runs.
  • Standard Schema keeps the router decoupled from any particular validation library (Zod, Valibot, ArkType all implement it), same approach TanStack Router took.

Open design questions:

  • Overload shape (query(schema, fn, name) vs options object) and how it interacts with multi-argument functions.
  • Validation failure behavior (throw a typed error? 400-style response for actions?).
  • Whether validation also runs on direct server-side calls or only across the RPC boundary.

Refs #507

Dominant language
TypeScript
Stars
1.3k
Forks
180
Avg merge
1d 6h
Merged PRs (30d)
20

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from solidjs/solid-router

All issues in solidjs/solid-router

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.