From c9638512328c72f16d13a873d319e1eb5efa955d Mon Sep 17 00:00:00 2001
From: SabFabDev <SabFabDev@users.noreply.github.com>
Date: Fri, 10 Jul 2026 17:44:56 +0200
Subject: [PATCH] fix(waitlist): reject invalid JSON requests

---
 .../app/api/waitlist/__tests__/route.test.ts  | 22 +++++++++++++++++++
 apps/web/src/app/api/waitlist/route.ts        | 12 +++++++++-
 2 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/apps/web/src/app/api/waitlist/__tests__/route.test.ts b/apps/web/src/app/api/waitlist/__tests__/route.test.ts
index 670753b..f67b2da 100644
--- a/apps/web/src/app/api/waitlist/__tests__/route.test.ts
+++ b/apps/web/src/app/api/waitlist/__tests__/route.test.ts
@@ -113,6 +113,28 @@ describe("POST /api/waitlist", () => {
     expect(res.status).toBe(400);
   });
 
+  it("returns 400 when JSON is not an object", async () => {
+    const res = await POST(makeRequest(null));
+    const body = await res.json();
+
+    expect(res.status).toBe(400);
+    expect(body.error).toBe("JSON object is required");
+  });
+
+  it("returns 400 for malformed JSON", async () => {
+    const req = new Request("http://localhost/api/waitlist", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: "{",
+    }) as unknown as import("next/server").NextRequest;
+
+    const res = await POST(req);
+    const body = await res.json();
+
+    expect(res.status).toBe(400);
+    expect(body.error).toBe("Invalid JSON");
+  });
+
   it("handles duplicate email gracefully — returns existing entry", async () => {
     selectResult = {
       data: {
diff --git a/apps/web/src/app/api/waitlist/route.ts b/apps/web/src/app/api/waitlist/route.ts
index 0d6644f..4da6dd1 100644
--- a/apps/web/src/app/api/waitlist/route.ts
+++ b/apps/web/src/app/api/waitlist/route.ts
@@ -23,8 +23,18 @@ function generateReferralCode(): string {
 }
 
 export async function POST(request: NextRequest) {
+  let body: { email?: unknown; payment_method?: string; referral_code?: string };
+  try {
+    const parsed: unknown = await request.json();
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return NextResponse.json({ error: "JSON object is required" }, { status: 400 });
+    }
+    body = parsed as typeof body;
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
+  }
+
   try {
-    const body = await request.json();
     const { email, payment_method, referral_code } = body;
 
     if (!email || typeof email !== "string" || !email.includes("@")) {