From 95ca1c1e21be22a20b486faeadc778b8e0c2274f Mon Sep 17 00:00:00 2001
From: Tanuu <tanujanair@Tanuus-MacBook-Air.local>
Date: Sun, 29 Mar 2026 20:17:48 +0530
Subject: [PATCH] fix: return 400 for invalid verify API payloads

---
 packages/web/src/__tests__/api-routes.test.ts | 25 +++++++++++++++++++
 packages/web/src/app/api/verify/route.ts      | 12 ++++++++-
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/packages/web/src/__tests__/api-routes.test.ts b/packages/web/src/__tests__/api-routes.test.ts
index 67f89bc8b..9aba8ff87 100644
--- a/packages/web/src/__tests__/api-routes.test.ts
+++ b/packages/web/src/__tests__/api-routes.test.ts
@@ -188,6 +188,7 @@ vi.mock("@/lib/services", () => ({
     registry: mockRegistry,
     sessionManager: mockSessionManager,
   })),
+  getVerifyIssues: vi.fn(async () => []),
   getSCM: vi.fn(() => mockSCM),
 }));
 
@@ -205,6 +206,7 @@ import { POST as mergePOST } from "@/app/api/prs/[id]/merge/route";
 import { GET as eventsGET } from "@/app/api/events/route";
 import { GET as observabilityGET } from "@/app/api/observability/route";
 import { GET as runtimeTerminalGET } from "@/app/api/runtime/terminal/route";
+import { GET as verifyGET, POST as verifyPOST } from "@/app/api/verify/route";
 
 function makeRequest(url: string, init?: RequestInit): NextRequest {
   return new NextRequest(
@@ -986,4 +988,27 @@ describe("API Routes", () => {
       expect(data).toHaveProperty("projects");
     });
   });
+
+  describe("GET /api/verify", () => {
+    it("returns verify issues", async () => {
+      const res = await verifyGET();
+      expect(res.status).toBe(200);
+      const data = await res.json();
+      expect(Array.isArray(data.issues)).toBe(true);
+    });
+  });
+
+  describe("POST /api/verify", () => {
+    it("returns 400 for invalid JSON body", async () => {
+      const req = makeRequest("/api/verify", {
+        method: "POST",
+        body: "not json",
+        headers: { "Content-Type": "application/json" },
+      });
+      const res = await verifyPOST(req);
+      expect(res.status).toBe(400);
+      const data = await res.json();
+      expect(data.error).toMatch(/Invalid JSON body/);
+    });
+  });
 });
diff --git a/packages/web/src/app/api/verify/route.ts b/packages/web/src/app/api/verify/route.ts
index 12f059ab5..f0c00e847 100644
--- a/packages/web/src/app/api/verify/route.ts
+++ b/packages/web/src/app/api/verify/route.ts
@@ -26,7 +26,17 @@ export async function GET() {
  */
 export async function POST(req: NextRequest) {
   try {
-    const body = await req.json();
+    const body = (await req.json().catch(() => null)) as
+      | {
+          issueId?: string;
+          projectId?: string;
+          action?: "verify" | "fail";
+          comment?: string;
+        }
+      | null;
+    if (!body) {
+      return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+    }
     const { issueId, projectId, action, comment } = body as {
       issueId: string;
       projectId: string;