fix: task-4 review round 1 (soon-constant, computed status, id guard)

app/api/vouchers/[id]/route.ts

@@ -3,18 +3,22 @@ import { getDb } from "@/lib/db";
 
 export async function GET(_req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params;
+  const numId = Number(id);
+  if (!Number.isInteger(numId)) return NextResponse.json({ error: "not found" }, { status: 404 });
   const db = getDb();
-  const v = await db.voucher.findUnique({ where: { id: Number(id) } });
+  const v = await db.voucher.findUnique({ where: { id: numId } });
   if (!v) return NextResponse.json({ error: "not found" }, { status: 404 });
   return NextResponse.json(v);
 }
 
 export async function POST(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params;
+  const numId = Number(id);
+  if (!Number.isInteger(numId)) return NextResponse.json({ error: "not found" }, { status: 404 });
   const body = await req.json().catch(() => ({}));
   if (body.action !== "redeem") return NextResponse.json({ error: "unknown action" }, { status: 400 });
   const db = getDb();
-  const v = await db.voucher.findUnique({ where: { id: Number(id) } });
+  const v = await db.voucher.findUnique({ where: { id: numId } });
   if (!v) return NextResponse.json({ error: "not found" }, { status: 404 });
   const updated = await db.voucher.update({ where: { id: v.id }, data: { status: "eingeloest", restCents: 0 } });
   return NextResponse.json(updated);