Bug: GET /item/steal returns 500 internal server error, if no request body is provided

[tickBit]

What doesn't work?

GET /item/steal returns 500 Internal Server Error when the request does not include steal_token or the request body is missing/undefined.

The likely bug is in StealTokenGuard:

const stealToken = request.query.steal_token ?? request.body.steal_token;

For a GET request, request.body may be undefined. In that case, accessing request.body.steal_token throws a TypeError before the guard can return the intended authorization error.

Expected result: the endpoint should return 403 Forbidden with the existing steal_token is not provided API error.

Actual result: in some environments, the endpoint returns 500 Internal Server Error.

What is the endpoint and method? (if applicable)

Endpoint: /item/steal

Method: GET

How can it be reproduced?

1. Send a GET request to /item/steal.
2. Do not include steal_token in the query string.
3. Make sure the request has no body.
4. Observe that the server may return 500 Internal Server Error.

Likely fix area: src/clanInventory/item/guards/StealToken.guard.ts, where request.body should be accessed safely.