Harden CMS security and theme contrast

src/app/api/me/route.ts

@@ -2,18 +2,19 @@
 //
 // Reads the NextAuth session, then re-queries prisma.user by the session id to
 // return a safe field set (never password / auth_ticket / 2FA secrets / pincode
-// / mail). Returns { user: null } when unauthenticated or on DB failure.
+// / mail). Returns { user: null } only when unauthenticated or missing.
 
-import { apiJson } from "@/lib/api";
+import { apiJson, apiUnavailable } from "@/lib/api";
 import { auth } from "@/lib/auth";
 import { prisma } from "@/lib/prisma";
+import { sessionUserId } from "@/lib/auth/session-user";
 
 export const dynamic = "force-dynamic";
 
 export async function GET(_req: Request) {
   const session = await auth();
-  const id = session?.user?.id ? Number(session.user.id) : null;
-  if (!id || Number.isNaN(id)) {
+  const id = sessionUserId(session?.user?.id);
+  if (!id) {
     return apiJson({ user: null });
   }
 
@@ -55,6 +56,6 @@ export async function GET(_req: Request) {
       },
     });
   } catch {
-    return apiJson({ user: null });
+    return apiUnavailable("Account data is temporarily unavailable");
   }
 }