From a5c575444ba698624b3932b4d6414c5ad9df282a Mon Sep 17 00:00:00 2001
From: Dries Augustyns <inbox@driaug.com>
Date: Sun, 4 Jan 2026 17:27:27 +0100
Subject: [PATCH] fix: Catch unknown content-type headers

---
 apps/api/src/app.ts | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/apps/api/src/app.ts b/apps/api/src/app.ts
index 86b2724..55408e5 100644
--- a/apps/api/src/app.ts
+++ b/apps/api/src/app.ts
@@ -154,6 +154,34 @@ interface ErrorResponse {
 server.app.use((error: Error, req: Request, res: Response, _next: NextFunction) => {
   const requestId = res.locals.requestId as string | undefined;
 
+  // Handle JSON parsing errors (from express.json() middleware)
+  if (error instanceof SyntaxError && 'body' in error) {
+    const statusCode = 400;
+
+    logger.warn(
+      'JSON parsing failed',
+      {
+        endpoint: `${req.method} ${req.path}`,
+        contentType: req.get('content-type'),
+      },
+      res,
+    );
+
+    const response: ErrorResponse = {
+      success: false,
+      error: {
+        code: ErrorCode.VALIDATION_ERROR,
+        message: 'Invalid JSON in request body',
+        statusCode,
+        requestId,
+        suggestion: 'Ensure your request body is valid JSON and Content-Type header is set to "application/json".',
+      },
+      timestamp: new Date().toISOString(),
+    };
+
+    return res.status(statusCode).json(response);
+  }
+
   // Handle Zod validation errors
   if (error instanceof ZodError) {
     const fieldErrors: FieldError[] = error.errors.map(err => ({