fix(webapp): return 400 (not 500) on malformed JSON body in management API routes

Author: nicktrn

apps/webapp/app/routes/api.v1.orgs.$orgParam.invites.ts

@@ -55,7 +55,14 @@ export async function action({ request, params }: ActionFunctionArgs) {
     });
     if (denied) return denied;
 
-    const body = InviteRequestBody.safeParse(await request.json());
+    let rawBody: unknown;
+    try {
+      rawBody = await request.json();
+    } catch {
+      return json({ error: "Invalid request body" }, { status: 400 });
+    }
+
+    const body = InviteRequestBody.safeParse(rawBody);
 
     if (!body.success) {
       return json({ error: "Invalid request body" }, { status: 400 });

apps/webapp/app/routes/api.v1.orgs.$orgParam.ts

@@ -64,7 +64,14 @@ export async function action({ request, params }: ActionFunctionArgs) {
       return json({ id: organization.id });
     }
 
-    const body = RenameOrgRequestBody.safeParse(await request.json());
+    let rawBody: unknown;
+    try {
+      rawBody = await request.json();
+    } catch {
+      return json({ error: "Invalid request body" }, { status: 400 });
+    }
+
+    const body = RenameOrgRequestBody.safeParse(rawBody);
 
     if (!body.success) {
       return json({ error: "Invalid request body" }, { status: 400 });

apps/webapp/app/routes/api.v1.orgs.ts

@@ -62,7 +62,14 @@ export async function action({ request }: ActionFunctionArgs) {
       return json({ error: "Invalid or Missing Access Token" }, { status: 401 });
     }
 
-    const body = CreateOrgRequestBody.safeParse(await request.json());
+    let rawBody: unknown;
+    try {
+      rawBody = await request.json();
+    } catch {
+      return json({ error: "Invalid request body" }, { status: 400 });
+    }
+
+    const body = CreateOrgRequestBody.safeParse(rawBody);
 
     if (!body.success) {
       return json({ error: "Invalid request body" }, { status: 400 });

apps/webapp/app/routes/api.v1.projects.$projectRef.default-region.ts

@@ -54,7 +54,14 @@ export async function action({ request, params }: ActionFunctionArgs) {
       return json({ error: "Project not found" }, { status: 404 });
     }
 
-    const body = SetDefaultRegionRequestBody.safeParse(await request.json());
+    let rawBody: unknown;
+    try {
+      rawBody = await request.json();
+    } catch {
+      return json({ error: "Invalid request body" }, { status: 400 });
+    }
+
+    const body = SetDefaultRegionRequestBody.safeParse(rawBody);
 
     if (!body.success) {
       return json({ error: "Invalid request body" }, { status: 400 });

apps/webapp/app/routes/api.v1.projects.$projectRef.ts

@@ -123,7 +123,14 @@ export async function action({ request, params }: ActionFunctionArgs) {
       return json({ id: project.id });
     }
 
-    const body = RenameProjectRequestBody.safeParse(await request.json());
+    let rawBody: unknown;
+    try {
+      rawBody = await request.json();
+    } catch {
+      return json({ error: "Invalid request body" }, { status: 400 });
+    }
+
+    const body = RenameProjectRequestBody.safeParse(rawBody);
 
     if (!body.success) {
       return json({ error: "Invalid request body" }, { status: 400 });