Nuxt 4 - Server API Route with Validation

// server/api/users/[id].post.ts
import { z } from 'zod'

const updateUserSchema = z.object({
  name: z.string().min(2).max(100),
  email: z.string().email(),
  role: z.enum(['admin', 'user', 'guest']).optional(),
})

export default defineEventHandler(async (event) => {
  const id = getRouterParam(event, 'id')

  // Validate request body
  const body = await readBody(event)
  const validatedData = updateUserSchema.parse(body)

  // Check authentication
  const session = await requireUserSession(event)
  if (session.user.id !== id && !session.user.isAdmin) {
    throw createError({
      statusCode: 403,
      message: 'Unauthorized',
    })
  }

  // Update user
  const user = await prisma.user.update({
    where: { id },
    data: validatedData,
  })

  return user
})