From 22190f38fd90fdb6e4d9696b532f013fc2bbd4ee Mon Sep 17 00:00:00 2001
From: Bas van den Aakster <bvdaakster@gmail.com>
Date: Sun, 14 Sep 2025 19:56:19 +0200
Subject: [PATCH] Fix critical type safety and validation issues
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Replace unsafe (payload as any).mailing with proper type checking
- Add validation for required fields (to, templateSlug/subject+html)
- Return proper 400 status codes for invalid requests
- Improve type safety without breaking existing functionality

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 dev/app/api/test-email/route.ts | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/dev/app/api/test-email/route.ts b/dev/app/api/test-email/route.ts
index fe11153..3b8f9b4 100644
--- a/dev/app/api/test-email/route.ts
+++ b/dev/app/api/test-email/route.ts
@@ -8,6 +8,22 @@ export async function POST(request: Request) {
     const body = await request.json()
     const { type = 'send', templateSlug, to, variables, scheduledAt, subject, html, text } = body
 
+    // Validate required fields
+    if (!to) {
+      return Response.json(
+        { error: 'Recipient email address (to) is required' },
+        { status: 400 }
+      )
+    }
+
+    // Validate email has either template or direct content
+    if (!templateSlug && (!subject || !html)) {
+      return Response.json(
+        { error: 'Either templateSlug or both subject and html must be provided' },
+        { status: 400 }
+      )
+    }
+
     // Use the new sendEmail API
     const emailOptions: any = {
       data: {
@@ -105,8 +121,8 @@ export async function GET() {
         total: totalDocs,
       },
       mailing: {
-        pluginActive: !!(payload as any).mailing,
-        service: !!(payload as any).mailing?.service,
+        pluginActive: 'mailing' in payload && !!payload.mailing,
+        service: 'mailing' in payload && payload.mailing && 'service' in payload.mailing && !!payload.mailing.service,
       },
     })
   } catch (error) {