fix(api): reject malformed user-papers and upload requests

src/app/api/upload/route.ts

@@ -8,11 +8,20 @@ export const runtime = "nodejs";
 export async function POST(req: Request) {
   try {
     const formData = await req.formData();
-    const files = formData.getAll("files").filter(Boolean) as File[];
+    const uploads = formData.getAll("files");
+    const files = uploads.filter((upload): upload is File => typeof upload !== "string");
     const isPdf = formData.get("isPdf") === "true";
     const thumbnail = formData.get("thumbnail") as File | null;
     const campus = formData.get("campus") as string | null;
 
+    if (files.length !== uploads.length) {
+      return failure("every entry in files has to be a file", 400);
+    }
+
+    if (isPdf && files.length > 1) {
+      return failure("upload one pdf at a time", 400);
+    }
+
     if (files.length === 0) {
       return failure("No files received.", 400);
     }

src/app/api/user-papers/route.ts

@@ -1,14 +1,21 @@
-import { type StoredSubjects } from "@/interface";
+import { z } from "zod";
 import { getPapersBySubjects } from "@/lib/services/paper"
 import { success, failure } from "@/lib/utils/response";
 
 export const dynamic = "force-dynamic";
 
+const pinnedSubjects = z.array(z.string().trim().min(1).max(200)).max(100);
+
 export async function POST(req: Request) {
   try {
-    const subjects = (await req.json()) as StoredSubjects;
+    const body: unknown = await req.json().catch(() => null);
+    const subjects = pinnedSubjects.safeParse(body);
+
+    if (!subjects.success) {
+      return failure("send a list of up to 100 subject names", 400);
+    }
 
-    const transformedPapers = await getPapersBySubjects(subjects)
+    const transformedPapers = await getPapersBySubjects(subjects.data)
 
     return success(transformedPapers);
   } catch (error) {