fix(waitlist): reject invalid JSON requests

apps/web/src/app/api/waitlist/__tests__/route.test.ts

@@ -113,6 +113,28 @@ describe("POST /api/waitlist", () => {
     expect(res.status).toBe(400);
   });
 
+  it("returns 400 when JSON is not an object", async () => {
+    const res = await POST(makeRequest(null));
+    const body = await res.json();
+
+    expect(res.status).toBe(400);
+    expect(body.error).toBe("JSON object is required");
+  });
+
+  it("returns 400 for malformed JSON", async () => {
+    const req = new Request("http://localhost/api/waitlist", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: "{",
+    }) as unknown as import("next/server").NextRequest;
+
+    const res = await POST(req);
+    const body = await res.json();
+
+    expect(res.status).toBe(400);
+    expect(body.error).toBe("Invalid JSON");
+  });
+
   it("handles duplicate email gracefully — returns existing entry", async () => {
     selectResult = {
       data: {

apps/web/src/app/api/waitlist/route.ts

@@ -23,8 +23,18 @@ function generateReferralCode(): string {
 }
 
 export async function POST(request: NextRequest) {
+  let body: { email?: unknown; payment_method?: string; referral_code?: string };
+  try {
+    const parsed: unknown = await request.json();
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return NextResponse.json({ error: "JSON object is required" }, { status: 400 });
+    }
+    body = parsed as typeof body;
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
+  }
+
   try {
-    const body = await request.json();
     const { email, payment_method, referral_code } = body;
 
     if (!email || typeof email !== "string" || !email.includes("@")) {