Harden CMS security and theme contrast

src/app/api/values/route.ts

@@ -1,7 +1,7 @@
 // Public REST: rare furni trade values (website_rare_values).
 // AtomCMS JSON API parity — read-only catalog of rares with their credit /
 // currency values. Supports ?category=<id> filter; paginated, ordered by name.
-import { apiJson, pagination } from "@/lib/api";
+import { apiError, apiJson, pagination, positiveBigInt } from "@/lib/api";
 import { prisma } from "@/lib/prisma";
 
 export const dynamic = "force-dynamic";
@@ -13,12 +13,10 @@ export async function GET(req: Request) {
   // Optional ?category=<id> filter (category_id is a BigInt).
   const categoryRaw = sp.get("category");
   let where: { categoryId?: bigint } = {};
-  if (categoryRaw && /^\d+$/.test(categoryRaw)) {
-    try {
-      where = { categoryId: BigInt(categoryRaw) };
-    } catch {
-      where = {};
-    }
+  if (categoryRaw !== null) {
+    const categoryId = positiveBigInt(categoryRaw);
+    if (!categoryId) return apiError("A valid category id is required", 422);
+    where = { categoryId };
   }
 
   try {