Harden CMS security and theme contrast

src/app/api/tickets/route.ts

@@ -4,7 +4,7 @@
 // Backed by website_help_center_tickets (WebsiteHelpCenterTickets). Fail-soft:
 // DB errors return an apiError envelope, never a 500.
 
-import { apiError, apiJson } from "@/lib/api";
+import { apiError, apiJson, positiveBigInt } from "@/lib/api";
 import { bearerUserId } from "@/lib/api-auth";
 import { prisma } from "@/lib/prisma";
 
@@ -59,8 +59,8 @@ export async function POST(req: Request) {
   // value, otherwise leave it null.
   let categoryId: bigint | null = null;
   if (body.categoryId !== undefined && body.categoryId !== null && body.categoryId !== "") {
-    const raw = String(body.categoryId);
-    if (/^\d+$/.test(raw)) categoryId = BigInt(raw);
+    categoryId = positiveBigInt(String(body.categoryId));
+    if (!categoryId) return apiError("A valid category id is required", 422);
   }
 
   try {