fix: resolve issues #463-#466 - Zod type exports, CI workflow, dep checker

- Issue #463: users.validation.ts and invitations.validation.ts already had
  clean inferred type exports; no changes needed.
- Issue #464: Update shipments.controller.ts to import and use all Zod-inferred
  types (CreateShipmentInput, ShipmentIdParam, ShipmentPatchBody,
  ShipmentStatusInput) from shipments.validation.ts across all 9 handlers.
- Issue #465: .github/workflows/typecheck.yml and README.md badge already exist.
- Issue #466: Fix duplicate check:deps key in package.json (JSON validity bug).
- Bonus: Fix auth.routes.ts duplicate setup2faController import (TS2300).
- Bonus: Migrate twoFactor.service.ts from otplib v12 authenticator API to
  v13 functional API (generateSecret, generateURI, verifySync).

Author: lettalkdata-cloud

package.json

@@ -8,7 +8,6 @@
     "start": "node dist/src/main.js",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "check:deps": "node scripts/check-undeclared-deps.js",
-    "check:deps": "node scripts/check-undeclared-deps.js",
     "lint": "eslint src --ext .ts",
     "lint:fix": "eslint src --ext .ts --fix",
     "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",

src/modules/auth/auth.routes.ts

@@ -22,7 +22,6 @@ import {
   resetPasswordController,
   refreshController,
   registerCompanyController,
-  setup2faController,
 } from './auth.controller.js';
 import {
   createApiKeyController,
@@ -132,6 +131,7 @@ authRouter.post(
   '/2fa/backup-codes/regenerate',
   asyncHandler(requireAuth),
   asyncHandler(regenerateBackupCodesController)
+);
 // Session management routes (protected by JWT auth)
 authRouter.get('/sessions', asyncHandler(requireAuth), asyncHandler(listSessionsController));
 authRouter.delete(

src/modules/auth/twoFactor.service.ts

@@ -1,6 +1,6 @@
 import bcrypt from 'bcrypt';
 import { randomBytes } from 'crypto';
-import { authenticator } from 'otplib';
+import { generateSecret, generateURI, verifySync } from 'otplib';
 import { AppError, ErrorCodes } from '../../shared/http/errors.js';
 import { UserModel } from '../users/users.model.js';
 
@@ -52,12 +52,12 @@ export async function setup2fa(userId: string): Promise<{ otpauthUrl: string; se
     throw new AppError(409, '2FA is already enabled', ErrorCodes.TOTP_ALREADY_ENABLED);
   }
 
-  const secret = authenticator.generateSecret();
+  const secret = generateSecret();
 
   // Store the pending secret (not yet active — totpEnabled stays false)
   await UserModel.findByIdAndUpdate(userId, { totpSecret: secret });
 
-  const otpauthUrl = authenticator.keyuri(user.email as string, 'Navin', secret);
+  const otpauthUrl = generateURI({ label: user.email as string, issuer: 'Navin', secret });
 
   return { otpauthUrl, secret };
 }
@@ -96,8 +96,8 @@ export async function verify2fa(userId: string, code: string): Promise<{ backupC
     throw new AppError(409, '2FA is already enabled', ErrorCodes.TOTP_ALREADY_ENABLED);
   }
 
-  const isValid = authenticator.verify({ token: code, secret: user.totpSecret as string });
-  if (!isValid) {
+  const verifyResult = verifySync({ token: code, secret: user.totpSecret as string });
+  if (!verifyResult.valid) {
     throw new AppError(400, 'Invalid TOTP code', ErrorCodes.TOTP_INVALID_CODE);
   }
 

src/modules/shipments/shipments.controller.ts

@@ -27,6 +27,10 @@ import type {
   UploadDocumentBody,
   UploadPhotoBody,
   CreateDisputeBody,
+  CreateShipmentInput,
+  ShipmentIdParam,
+  ShipmentPatchBody,
+  ShipmentStatusInput,
 } from './shipments.validation.js';
 import { AppError, ErrorCodes } from '../../shared/http/errors.js';
 
@@ -112,7 +116,7 @@ export const getShipments = async (req: Request, res: Response) => {
  * @throws {AppError} 400 VALIDATION_ERROR — when the id param is invalid.
  */
 export const getShipmentById = async (req: Request, res: Response) => {
-  const { id } = req.params;
+  const { id } = req.params as unknown as ShipmentIdParam;
   const shipment = await getShipmentByIdService(id, {
     organizationId: req.user?.organizationId,
     role: req.user?.role,
@@ -134,7 +138,7 @@ export const getShipmentById = async (req: Request, res: Response) => {
  * @throws {AppError} 400 VALIDATION_ERROR — when params/query validation fails.
  */
 export const getShipmentTimeline = async (req: Request, res: Response) => {
-  const { id } = req.params;
+  const { id } = req.params as unknown as ShipmentIdParam;
   const query = req.query as unknown as ShipmentTimelineQuery;
   const { cursor, limit = 20 } = query;
   const { data, nextCursor, hasMore } = await getShipmentTimelineService(id, {
@@ -161,7 +165,8 @@ export const getShipmentTimeline = async (req: Request, res: Response) => {
  * @throws {AppError} 400 VALIDATION_ERROR — when body validation fails.
  */
 export const createShipment = async (req: Request, res: Response) => {
-  const shipment = await createShipmentService({ ...req.body, actorUserId: req.user?.userId });
+  const body = req.body as CreateShipmentInput;
+  const shipment = await createShipmentService({ ...body, actorUserId: req.user?.userId });
   sendResponse(res, 201, true, 'Shipment created', shipment);
 };
 
@@ -176,8 +181,8 @@ export const createShipment = async (req: Request, res: Response) => {
  * @throws {AppError} 400 VALIDATION_ERROR — when params/body validation fails.
  */
 export const patchShipment = async (req: Request, res: Response) => {
-  const { id } = req.params;
-  const { offChainMetadata } = req.body;
+  const { id } = req.params as unknown as ShipmentIdParam;
+  const { offChainMetadata } = req.body as ShipmentPatchBody;
   const shipment = await patchShipmentService(id, offChainMetadata);
   if (!shipment) {
     sendResponse(res, 404, false, 'Shipment not found', null);
@@ -198,8 +203,8 @@ export const patchShipment = async (req: Request, res: Response) => {
  * @throws {AppError} 400 VALIDATION_ERROR — when params/body validation fails.
  */
 export const patchShipmentStatus = async (req: Request, res: Response) => {
-  const { id } = req.params;
-  const { status } = req.body;
+  const { id } = req.params as unknown as ShipmentIdParam;
+  const { status } = req.body as ShipmentStatusInput;
 
   if (!status || typeof status !== 'string') {
     sendResponse(res, 400, false, 'Missing status', null);
@@ -238,7 +243,7 @@ export const patchShipmentStatus = async (req: Request, res: Response) => {
  * @throws {AppError} 400 VALIDATION_ERROR — when params/body validation fails.
  */
 export const uploadShipmentProof = async (req: Request, res: Response) => {
-  const { id } = req.params;
+  const { id } = req.params as unknown as ShipmentIdParam;
   const { recipientSignatureName, notes } = req.body as ShipmentProofBody;
   const file = req.file;
 
@@ -272,7 +277,7 @@ export const uploadShipmentProof = async (req: Request, res: Response) => {
  * @throws {AppError} 400 VALIDATION_ERROR — when params/body validation fails.
  */
 export const uploadShipmentDocument = async (req: Request, res: Response) => {
-  const { id } = req.params;
+  const { id } = req.params as unknown as ShipmentIdParam;
   const { type } = req.body as UploadDocumentBody;
   const file = req.file;
 
@@ -318,7 +323,7 @@ export const uploadShipmentDocument = async (req: Request, res: Response) => {
  * @throws {AppError} 400 VALIDATION_ERROR — when params/body validation fails.
  */
 export const uploadShipmentPhoto = async (req: Request, res: Response) => {
-  const { id } = req.params;
+  const { id } = req.params as unknown as ShipmentIdParam;
   const { caption } = req.body as UploadPhotoBody;
   const file = req.file;
 
@@ -361,7 +366,7 @@ export const uploadShipmentPhoto = async (req: Request, res: Response) => {
  * @throws {AppError} 400 VALIDATION_ERROR — when params/body validation fails.
  */
 export const createDispute = async (req: Request, res: Response) => {
-  const { id } = req.params;
+  const { id } = req.params as unknown as ShipmentIdParam;
   const { type, description } = req.body as CreateDisputeBody;
   const file = req.file;
 
@@ -427,7 +432,7 @@ export const exportShipments = async (req: Request, res: Response) => {
  * @throws {AppError} 400 VALIDATION_ERROR — when the id param is invalid.
  */
 export const deleteShipment = async (req: Request, res: Response) => {
-  const { id } = req.params;
+  const { id } = req.params as unknown as ShipmentIdParam;
   const shipment = await deleteShipmentService(id);
 
   if (!shipment) {
@@ -451,7 +456,7 @@ export const deleteShipment = async (req: Request, res: Response) => {
  * @throws {AppError} 400 VALIDATION_ERROR — when the id param is invalid.
  */
 export const getShipmentEta = async (req: Request, res: Response) => {
-  const { id } = req.params;
+  const { id } = req.params as unknown as ShipmentIdParam;
   const eta = await getShipmentEtaService(id);
   sendResponse(res, 200, true, 'Shipment ETA retrieved', eta);
 };