feat: add Zod validation schemas for all domain routes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/routes/admin/scope-templates.ts

@@ -2,6 +2,8 @@ import { FastifyInstance } from 'fastify';
 import prisma from '../../config/database';
 import { requirePermission } from '../../middleware/auth';
 import { success, error, parseId } from '../../utils/response';
+import { parseBody } from '../../schemas/common';
+import { CreateScopeTemplateSchema, CreateItemTemplateSchema, UpdateScopeTemplateSchema } from '../../schemas/scope-templates.schema';
 
 interface ScopeSectionInput { title?: string; title_cz?: string; content?: string; position?: number }
 
@@ -32,9 +34,11 @@ export default async function scopeTemplatesRoutes(fastify: FastifyInstance): Pr
   // Item template CRUD via ?action=item
   fastify.post('/', { preHandler: requirePermission('offers.settings') }, async (request, reply) => {
     const query = request.query as Record<string, unknown>;
-    const body = request.body as Record<string, unknown>;
 
     if (String(query.action) === 'item') {
+      const itemParsed = parseBody(CreateItemTemplateSchema, request.body);
+      if ('error' in itemParsed) return error(reply, itemParsed.error, 400);
+      const body = itemParsed.data;
       const itemData = {
         name: body.name ? String(body.name) : null,
         description: body.description ? String(body.description) : null,
@@ -58,6 +62,10 @@ export default async function scopeTemplatesRoutes(fastify: FastifyInstance): Pr
     }
 
     // Scope template create (original logic below)
+    const scopeParsed = parseBody(CreateScopeTemplateSchema, request.body);
+    if ('error' in scopeParsed) return error(reply, scopeParsed.error, 400);
+    const body = scopeParsed.data;
+
     const template = await prisma.scope_templates.create({
       data: {
         name: body.name ? String(body.name) : null,
@@ -108,7 +116,9 @@ export default async function scopeTemplatesRoutes(fastify: FastifyInstance): Pr
   fastify.put<{ Params: { id: string } }>('/:id', { preHandler: requirePermission('offers.settings') }, async (request, reply) => {
     const id = parseId(request.params.id, reply);
     if (id === null) return;
-    const body = request.body as Record<string, unknown>;
+    const parsed = parseBody(UpdateScopeTemplateSchema, request.body);
+    if ('error' in parsed) return error(reply, parsed.error, 400);
+    const body = parsed.data;
 
     const existing = await prisma.scope_templates.findUnique({ where: { id } });
     if (!existing) return error(reply, 'Šablona nenalezena', 404);