Summary
`AccountsController.RevokeToken` dereferences `model.Token` without a null-conditional even though `model` is typed as nullable.
Details
`src/Inshapardaz.Api/Controllers/AccountsController.cs:60-62`:
```csharp
public async Task RevokeToken([FromBody] RevokeTokenRequest? model, CancellationToken cancellationToken)
{
var token = model.Token ?? Request.Cookies["refreshToken"];
```
Impact
A request with an empty/missing JSON body can leave `model` null, causing an unhandled `NullReferenceException` that surfaces as a generic 500 instead of a clean 400 or falling back to the cookie as presumably intended.
Suggested fix
Use `model?.Token ?? Request.Cookies["refreshToken"]`.
Summary
`AccountsController.RevokeToken` dereferences `model.Token` without a null-conditional even though `model` is typed as nullable.
Details
`src/Inshapardaz.Api/Controllers/AccountsController.cs:60-62`:
```csharp
public async Task RevokeToken([FromBody] RevokeTokenRequest? model, CancellationToken cancellationToken)
{
var token = model.Token ?? Request.Cookies["refreshToken"];
```
Impact
A request with an empty/missing JSON body can leave `model` null, causing an unhandled `NullReferenceException` that surfaces as a generic 500 instead of a clean 400 or falling back to the cookie as presumably intended.
Suggested fix
Use `model?.Token ?? Request.Cookies["refreshToken"]`.