Bug description
POST /api/wallet/zap parses the request body with await request.json() after authentication, then validates it with Zod. If an authenticated client sends malformed JSON, the parse exception falls through the outer catch block and the route returns 500 { "error": "An unexpected error occurred" }.
This is a client input error and should not reach wallet lookup, Lightning balance checks, transfer logic, zap persistence, notifications, or reputation hooks.
Steps to reproduce
- Authenticate as a user.
- Send
POST /api/wallet/zap with Content-Type: application/json and malformed JSON such as {not valid json.
- The route returns 500 instead of 400.
Expected behavior
Malformed or non-object JSON request bodies should return 400 { "error": "Invalid request body" }. Valid JSON with missing or invalid zap fields should continue through the existing Zod validation path.
Fix direction
Parse the zap request body defensively, reject non-object bodies before Zod validation, and add route regression coverage proving malformed bodies stop before wallet or transfer logic.
Filed for the active uGig repo testing task: https://ugig.net/gigs/4741218f-a723-46bb-82cb-6516120331ae
Bug description
POST /api/wallet/zapparses the request body withawait request.json()after authentication, then validates it with Zod. If an authenticated client sends malformed JSON, the parse exception falls through the outer catch block and the route returns500 { "error": "An unexpected error occurred" }.This is a client input error and should not reach wallet lookup, Lightning balance checks, transfer logic, zap persistence, notifications, or reputation hooks.
Steps to reproduce
POST /api/wallet/zapwithContent-Type: application/jsonand malformed JSON such as{not valid json.Expected behavior
Malformed or non-object JSON request bodies should return
400 { "error": "Invalid request body" }. Valid JSON with missing or invalid zap fields should continue through the existing Zod validation path.Fix direction
Parse the zap request body defensively, reject non-object bodies before Zod validation, and add route regression coverage proving malformed bodies stop before wallet or transfer logic.
Filed for the active uGig repo testing task: https://ugig.net/gigs/4741218f-a723-46bb-82cb-6516120331ae