Problem
Document routes have zero request validation (document.controller.ts:14,22,194,321,554,827): non-string content crashes createDoc (TypeError → 500), arbitrary permission strings are persisted verbatim, malformed userId/allowSelfJoin types surface as Prisma 500s.
Fix
Add Zod schemas under server/src/validations/ mirroring the auth pattern and wire them into document.router.ts. Rate limiting is tracked separately in #37.
Problem
Document routes have zero request validation (
document.controller.ts:14,22,194,321,554,827): non-stringcontentcrashescreateDoc(TypeError → 500), arbitrarypermissionstrings are persisted verbatim, malformeduserId/allowSelfJointypes surface as Prisma 500s.Fix
Add Zod schemas under
server/src/validations/mirroring the auth pattern and wire them intodocument.router.ts. Rate limiting is tracked separately in #37.