From 301b4ed5359c51e77e5f393d9372dc6262d6b5dd Mon Sep 17 00:00:00 2001
From: Autowebassat-blip <autowebassat@gmail.com>
Date: Fri, 12 Jun 2026 06:03:19 +0200
Subject: [PATCH] Return 400 for invalid publish JSON (#20)

---
 apps/commandboard-api/src/index.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/apps/commandboard-api/src/index.ts b/apps/commandboard-api/src/index.ts
index 3e58460..36d438e 100644
--- a/apps/commandboard-api/src/index.ts
+++ b/apps/commandboard-api/src/index.ts
@@ -217,7 +217,14 @@ async function route(request: IncomingMessage, response: ServerResponse) {
   }
 
   if (request.method === "POST" && url.pathname === "/api/plugins/sh1pt/actions/publish") {
-    const body = await readJson(request);
+    let body: unknown;
+    try {
+      body = await readJson(request);
+    } catch {
+      json(response, 400, { error: "Invalid JSON body" });
+      return;
+    }
+
     if (!isRecord(body) || typeof body.action_id !== "string") {
       json(response, 422, { error: "Expected action_id" });
       return;