♻️ api: use safe parsing

pomelo/api/transactions/authorizations.ts

@@ -2,7 +2,7 @@ import type { VercelRequest, VercelResponse } from "@vercel/node";
 
 import buffer from "../../utils/buffer.js";
 import processTransaction from "../../utils/transaction.js";
-import type { AuthorizationRequest } from "../../utils/types.js";
+import { authorizationRequest } from "../../utils/types.js";
 import { signResponse, verifySignature } from "../../utils/verify.js";
 
 export const runtime = "nodejs";
@@ -25,6 +25,12 @@ export default async function authorizations(request: VercelRequest, response: V
     return response.status(403).end("forbidden");
   }
 
-  const tx = await processTransaction(JSON.parse(raw) as AuthorizationRequest);
-  return signResponse(request, response.status(200), JSON.stringify(tx));
+  const parsed = authorizationRequest.safeParse(raw);
+
+  if (parsed.success) {
+    const tx = await processTransaction(parsed.data);
+    return signResponse(request, response.status(200), JSON.stringify(tx));
+  } else {
+    return response.status(400).end("bad request");
+  }
 }