Harden CMS security and theme contrast

src/app/api/tickets/[id]/route.ts

@@ -4,7 +4,7 @@
 // together with its replies; reply author usernames are resolved in a single
 // users lookup. Fail-soft: never a 500.
 
-import { apiError, apiJson } from "@/lib/api";
+import { apiError, apiJson, positiveBigInt } from "@/lib/api";
 import { bearerUserId } from "@/lib/api-auth";
 import { prisma } from "@/lib/prisma";
 
@@ -16,8 +16,8 @@ export async function GET(req: Request, { params }: { params: Promise<{ id: stri
   if (!uid) return apiError("Unauthorized", 401);
 
   const { id } = await params;
-  if (!/^\d+$/.test(id)) return apiError("Invalid ticket id");
-  const ticketId = BigInt(id);
+  const ticketId = positiveBigInt(id);
+  if (!ticketId) return apiError("Invalid ticket id", 422);
 
   try {
     const ticket = await prisma.websiteHelpCenterTickets.findUnique({