fix: resolve all validate-schemas violations

[leecalcote]

Summary

• badge/api.yml: Added BadgePayload schema with only client-settable fields; updated POST /api/organizations/badges requestBody to reference BadgePayload instead of Badge
• design/design.yaml: Added additionalProperties: false at top level to prevent unknown fields in generated structs
• design/api.yml: Replaced DELETE /api/content/patterns (with requestBody) with POST /api/content/patterns/delete per bulk-delete REST convention
• event/api.yml: Replaced DELETE /events (with requestBody) with POST /events/delete per bulk-delete REST convention
• invitation/api.yml: Added InvitationPayload schema with only client-settable fields; updated POST and PUT requestBodies to reference InvitationPayload instead of Invitation

Test plan

• Run make validate-schemas — should report 0 violations
• Run make build to verify generated Go structs and TypeScript types are valid
• Run go test ./... to verify no Go compilation errors
• Run npm run build to verify TypeScript distribution builds cleanly

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[Copilot]

Pull request overview

This PR updates several v1beta1 OpenAPI/JSON schemas to satisfy make validate-schemas rules (notably: write-payload schemas for POST/PUT, additionalProperties: false on entity schemas, and avoiding DELETE request bodies by introducing POST /delete sub-resources).

Changes:

• Introduces dedicated *Payload schemas for badge and invitation write operations and updates POST/PUT request bodies to reference them.
• Replaces bulk DELETE endpoints that used request bodies with POST {resource}/delete endpoints.
• Tightens the Design entity JSON schema by setting additionalProperties: false at the top level.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
schemas/constructs/v1beta1/invitation/api.yml	Switches POST/PUT requestBody to InvitationPayload and adds the payload schema.
schemas/constructs/v1beta1/event/api.yml	Replaces bulk DELETE-with-body with POST /events/delete.
schemas/constructs/v1beta1/design/design.yaml	Adds additionalProperties: false at the top-level entity schema.
schemas/constructs/v1beta1/design/api.yml	Replaces bulk DELETE-with-body with POST /api/content/patterns/delete.
schemas/constructs/v1beta1/badge/api.yml	Switches requestBody to BadgePayload and adds the payload schema.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

InvitationPayload is described as a client write payload, but it still exposes server-controlled fields like owner_id (and is_default immediately below) in the request schema. If the backend binds these fields, clients could spoof ownership / default-invite state. Consider removing these fields from the payload schema (or marking them readOnly and ensuring the server ignores them) so only client-settable fields are accepted.

Suggested change

	owner_id:
	$ref: "../../v1alpha1/core/api.yml#/components/schemas/uuid"
	description: ID of the user who created the invitation.
	x-oapi-codegen-extra-tags:
	db: "owner_id"
	json: "owner_id,omitempty"
	is_default:
	type: boolean
	description: Indicates whether the invitation is a default invitation (open invite).
	x-oapi-codegen-extra-tags:
	db: "is_default"
	json: "is_default,omitempty"

[Copilot]

BadgePayload includes db struct tags via x-oapi-codegen-extra-tags. In this repo, *Payload schemas typically only specify json (and sometimes yaml) tags and avoid db tags to keep request/response DTOs separate from DB models (e.g., ConnectionPayload in schemas/constructs/v1beta1/connection/api.yml). Consider removing the db tags from BadgePayload properties.

[Copilot]

BadgePayload marks label as required, but its description says it is auto generated. If label is server-generated, it shouldn’t be required/accepted in the write payload (and should be readOnly on the response schema). If it’s client-provided, update the description to match.

[Copilot]

PR goal is to resolve validate-schemas violations, but this file still contains operationIds like deleteBadgeByID / getBadgeByID which violate Rule 3 (lower camelCase; "Id" suffix, not "ID"). These will keep make validate-schemas failing until renamed (e.g., deleteBadgeById, getBadgeById).

[Copilot]

InvitationPayload properties include db tags via x-oapi-codegen-extra-tags. Other write payload schemas in this repo typically avoid db tags (keeping DB models separate from request DTOs). Consider removing db tags from InvitationPayload fields unless this payload type is intentionally used as a persistence model.