fix: restrict dynamic journey responses

This commit is contained in:
Jesse_Chen
2026-07-19 09:54:56 +08:00
parent 806d2babbf
commit db5a6fbe52
3 changed files with 68 additions and 13 deletions
@@ -108,9 +108,13 @@ function dynamicActionMatchesPhase(value: {
const dynamicJourneyResponseSchema = z.object({
...responseCore,
scoring: versionedScoringSchema.nullable(),
answers: z.record(answerSchema).readonly(),
lifeEvents: z.array(lifeEventSchema).readonly(),
questionnaire: z.null(),
scoring: z.null(),
answers: z.record(answerSchema).refine(
(answers) => Object.keys(answers).length === 0,
"dynamic answers are server-private",
).readonly(),
lifeEvents: z.array(lifeEventSchema).max(0, "dynamic life events are server-private").readonly(),
candidateResult: candidateResultSchema.nullable(),
journeyProtocol: z.literal("dynamic-choice-v2"),
turnVersion: z.number().int().nonnegative(),
@@ -140,10 +140,10 @@ export function storedDynamicJourneyResponse(
return {
caseId: stored.id,
snapshot: stored.snapshot,
questionnaire: stored.questionnaire,
scoring: stored.scoring ?? null,
answers: stored.answers,
lifeEvents: stored.lifeEvents ?? [],
questionnaire: null,
scoring: null,
answers: {},
lifeEvents: [],
candidateResult: stored.candidateResult ?? null,
evidenceDraft: null,
...stored.dynamicTurnState,