Harden CMS security and theme contrast

src/actions/admin-vouchers.ts

@@ -3,6 +3,8 @@
 import { revalidatePath } from "next/cache";
 import { requireStaff } from "@/lib/admin/guard";
 import { prisma } from "@/lib/prisma";
+import { formPositiveBigInt } from "@/lib/form-data";
+import { logServerError } from "@/lib/server-log";
 
 export async function createVoucher(formData: FormData): Promise<void> {
   await requireStaff();
@@ -37,7 +39,8 @@ export async function createVoucher(formData: FormData): Promise<void> {
         updatedAt: now,
       },
     });
-  } catch {
+  } catch (error) {
+    logServerError("admin.voucher_create_failed", error);
     // Unique constraint on `code` (or DB unavailable) — swallow and re-render.
     return;
   }
@@ -48,19 +51,13 @@ export async function createVoucher(formData: FormData): Promise<void> {
 export async function deleteVoucher(formData: FormData): Promise<void> {
   await requireStaff();
 
-  const raw = String(formData.get("id") ?? "").trim();
-  if (!raw) return;
-
-  let id: bigint;
-  try {
-    id = BigInt(raw);
-  } catch {
-    return;
-  }
+  const id = formPositiveBigInt(formData, "id");
+  if (!id) return;
 
   try {
     await prisma.websiteShopVouchers.delete({ where: { id } });
-  } catch {
+  } catch (error) {
+    logServerError("admin.voucher_delete_failed", error, { voucherId: String(id) });
     return;
   }