test(api): validate ISO8601 date format parameter

app/api/streak/route.test.ts

@@ -558,10 +558,10 @@ describe('GET /api/streak', () => {
       expect(body.details.fieldErrors.year[0]).toContain('GitHub was founded in 2008');
     });
 
-    it('returns 200 for unknown ?date= parameter (not part of schema)', async () => {
-      const response = await GET(makeRequest({ user: 'octocat', date: '2026-15-40' }));
-      expect(response.status).toBe(200);
-    });
+    // it('returns 200 for unknown ?date= parameter (not part of schema)', async () => {
+    //   const response = await GET(makeRequest({ user: 'octocat', date: '2026-15-40' }));
+    //   expect(response.status).toBe(200);
+    // });
 
     it('returns 400 for malformed numeric year', async () => {
       const response = await GET(makeRequest({ user: 'octocat', year: '100000' }));
@@ -611,6 +611,16 @@ describe('GET /api/streak', () => {
 
       expect(response.status).toBe(200);
     });
+
+    describe('date parameter', () => {
+      it('returns 400 when an invalid ISO8601 calendar date format like "2026-15-40" is supplied', async () => {
+        const response = await GET(makeRequest({ user: 'octocat', date: '2026-15-40' }));
+        const body = await response.json();
+
+        expect(response.status).toBe(400);
+        expect(body.details.fieldErrors.date[0]).toContain('Invalid "date" format');
+      });
+    });
   });
 
   describe('radius parameter', () => {

lib/validations.test.ts

@@ -789,3 +789,14 @@ describe('streakParamsSchema — tz IANA timezone validation (Variation 4)', ()
     }
   });
 });
+
+describe('streakParamsSchema — date parameter validation', () => {
+  it('rejects an invalid ISO8601 calendar date format like "2026-15-40"', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'octocat',
+      date: '2026-15-40',
+    });
+
+    expect(result.success).toBe(false);
+  });
+});

lib/validations.ts

@@ -169,6 +169,16 @@ const baseStreakParamsSchema = z.object({
       },
       { message: 'Invalid "to" date format. Use ISO 8601 (e.g. 2023-12-31).' }
     ),
+  date: z
+    .string()
+    .optional()
+    .refine(
+      (val) => {
+        if (!val) return true;
+        return !isNaN(Date.parse(val));
+      },
+      { message: 'Invalid "date" format. Use ISO 8601.' }
+    ),
   tz: z
     .string()
     .optional()