[pacocartones]

Summary

• POST /api/plugins and PATCH /api/relay/tokens/[id] did not answer a request whose body is not JSON: the handler rejected instead. Both now answer 400 with { "error": "Invalid JSON body" }. A well-formed body behaves as before.
• Root cause: both handlers call await request.json() with no guard, so the SyntaxError from a malformed body escapes the handler. The fix wraps that call in the same guard fix(gamification): answer 400 for malformed JSON on the rotate, servers and federation score routes #16730 added to three gamification routes; fix(api): answer 400 for a non-integer limit, offset or page on the dashboard and management list routes #16661, fix(chat): answer 400 when the JSON body is not an object #16668 and fix(api): answer 400 for a JSON body that is not an object on the logs, settings and providers routes #16671 answer 400 for other malformed inputs on other routes.

Related Issues

• None found: no open or closed pull request or issue covers this (checked on 17 October by the touched paths, among open and closed pull requests, and by some function names; the 11 open pull requests the search listed touch none of plugins or relay).

Target Branch

• Base is the active release/v3.8.x branch (the highest open release/v*, here release/v3.8.52), not main

Proof Of Fix (required)

• TDD — a test that fails before the fix and passes after it.
  • Test file: tests/unit/api-malformed-json-400-plugins-relay.test.ts (new, 5 cases: a malformed body and a well-formed but invalid body for each route, and a malformed PATCH with no credentials, which must still answer 401).
  • Failing output before the fix (base release/v3.8.52 with only the two route files reverted):

    ✖ POST /api/plugins — malformed JSON body returns 400
      SyntaxError: Unexpected token 'o', "not-json" is not valid JSON
    ✖ PATCH /api/relay/tokens/[id] — malformed JSON body returns 400
      SyntaxError: Unexpected token 'o', "not-json" is not valid JSON
    ℹ tests 5
    ℹ pass 3
    ℹ fail 2
    

  • With the fix: 5 of 5 pass.
• Real-environment test: not needed, TDD covers it.

Scope

• Only the files the failing test proves need changing are touched: the two route files, the new test and a one-line changelog fragment.
• No test was weakened or deleted to make the suite pass.

Validation

• Change type: other (management API routes)
• Focused tests: the existing tests for these routes and for the sibling malformed-JSON file pass with the change (8374-plugins-status-optional, plugins-route-error-sanitization, plugins-api-routes, api-malformed-json-400 and relay-tokens-always-protected, run together with the new file: 59 of 59).
• prettier --check on the new test and eslint on plugins/route.ts and the new test are clean; check:ai-attribution and check:changelog-integrity pass. eslint on relay/tokens/[id]/route.ts reports two unused request parameters on the GET and DELETE signatures; they are on the base and this change adds none.
• Full CI: runs on this PR.

Reviewer Notes

• The new test calls the handlers directly. POST /api/plugins runs with no password configured, as in the sibling api-malformed-json-400.test.ts. PATCH /api/relay/tokens/[id] always requires management auth since fix(authz): keep relay token management authenticated when login is disabled #16976, so its requests carry a manage-scoped API key, as in relay-tokens-always-protected.test.ts, and the unauthenticated case checks that a malformed body still gets 401: the JSON guard runs after the auth check. I did not run the routes under the Next.js server, so I did not measure which HTTP status an unhandled rejection becomes there; the test shows only that the handler rejects.
• Changelog fragment: changelog.d/fixes/PENDING-plugins-relay-json-400.md, one line, left for you to rename.
• plugins/route.ts already fails prettier --check on the base (the long zod chain); I left that chain as it is.