dev work

src/pages/cap/redeem.ts

@@ -10,8 +10,21 @@ export const POST: APIRoute = async (context) => {
     );
   }
 
-  const { token, solutions } = await context.request.json();
-  if (!token || !solutions) {
+  let body: { token?: unknown; solutions?: unknown };
+  try {
+    body = await context.request.json();
+  } catch {
+    return new Response(JSON.stringify({ success: false }), { status: 400 });
+  }
+
+  const { token, solutions } = body ?? {};
+  if (
+    typeof token !== "string" ||
+    token.length > 256 ||
+    !Array.isArray(solutions) ||
+    solutions.length > 128 ||
+    !solutions.every((s) => typeof s === "number")
+  ) {
     return new Response(JSON.stringify({ success: false }), { status: 400 });
   }