frontend/src/routes/household/staples/+server.ts

@@ -10,6 +10,10 @@ export const PATCH: RequestHandler = async ({ request, fetch }) => {
 		return json({ error: 'id is required' }, { status: 400 });
 	}
 
+	if (typeof isStaple !== 'boolean') {
+		return json({ error: 'isStaple must be a boolean' }, { status: 400 });
+	}
+
 	const api = apiClient(fetch);
 	const { error } = await api.PATCH('/v1/ingredients/{id}', {
 		params: { path: { id } },

frontend/src/routes/household/staples/server.test.ts

@@ -60,4 +60,18 @@ describe('household staples PATCH handler', () => {
 		expect(response.status).toBe(400);
 		expect(mockPatch).not.toHaveBeenCalled();
 	});
+
+	it('returns 400 when isStaple is missing', async () => {
+		const response = await PATCH(createRequest({ id: 'ing-1' }));
+
+		expect(response.status).toBe(400);
+		expect(mockPatch).not.toHaveBeenCalled();
+	});
+
+	it('returns 400 when isStaple is not a boolean', async () => {
+		const response = await PATCH(createRequest({ id: 'ing-1', isStaple: 'yes' }));
+
+		expect(response.status).toBe(400);
+		expect(mockPatch).not.toHaveBeenCalled();
+	});
 });