fix: crash due to lack of input validation in WizardForm (#21990)

* fix: crash due to lack of input validation in WizardForm

* server side validation

* refactor

* refactor

apps/web/app/(use-page-wrapper)/auth/setup/page.tsx

@@ -2,6 +2,8 @@ import { withAppDirSsr } from "app/WithAppDirSsr";
 import type { PageProps as ServerPageProps } from "app/_types";
 import { _generateMetadata } from "app/_utils";
 import { cookies, headers } from "next/headers";
+import { redirect } from "next/navigation";
+import { z } from "zod";
 
 import { buildLegacyCtx } from "@lib/buildLegacyCtx";
 
@@ -21,11 +23,18 @@ export const generateMetadata = async () => {
 };
 
 const getData = withAppDirSsr<ClientPageProps>(getServerSideProps);
+const stepSchema = z.enum(["1", "2", "3", "4"]);
 
-const ServerPage = async ({ params, searchParams }: ServerPageProps) => {
-  const props = await getData(
-    buildLegacyCtx(await headers(), await cookies(), await params, await searchParams)
-  );
+const ServerPage = async ({ params, searchParams: _searchParams }: ServerPageProps) => {
+  const searchParams = await _searchParams;
+  const stepResult = stepSchema.safeParse(searchParams?.step);
+
+  // If step parameter is invalid, redirect to step 1
+  if (!stepResult.success) {
+    return redirect(`/auth/setup?step=1`);
+  }
+
+  const props = await getData(buildLegacyCtx(await headers(), await cookies(), await params, searchParams));
   return <Setup {...props} />;
 };