fix(invoices): add Zod query param validation to GET /

apps/api/src/routes/invoices.ts

@@ -44,13 +44,20 @@ const updateInvoiceSchema = z.object({
 });
 
 // List invoices
-invoicesRouter.get("/", async (c) => {
+const listInvoicesQuerySchema = z.object({
+  clientId: z.string().uuid().optional(),
+  appointmentId: z.string().uuid().optional(),
+  status: z.enum(["draft", "pending", "paid", "void"]).optional(),
+  limit: z.coerce.number().int().min(1).max(200).default(50),
+  offset: z.coerce.number().int().min(0).default(0),
+});
+
+invoicesRouter.get(
+  "/",
+  zValidator("query", listInvoicesQuerySchema),
+  async (c) => {
     const db = getDb();
-  const clientId = c.req.query("clientId");
+    const { clientId, appointmentId, status, limit, offset } = c.req.valid("query");
-  const appointmentId = c.req.query("appointmentId");
-  const status = c.req.query("status");
-  const limit = Math.min(parseInt(c.req.query("limit") || "50", 10), 200);
-  const offset = parseInt(c.req.query("offset") || "0", 10);
 
     const conditions = [];
     if (clientId) conditions.push(eq(invoices.clientId, clientId));
@@ -89,7 +96,8 @@ invoicesRouter.get("/", async (c) => {
       .offset(offset);
 
     return c.json({ data: rows, total: totalResult?.count ?? 0 });
-});
+  }
+);
 
 // Get single invoice with line items and tip splits
 invoicesRouter.get("/:id", async (c) => {