Fix input validation and meta type alignment in apps/me API routes

apps/me/src/app/api/profile/avatar/route.ts

@@ -16,15 +16,17 @@ export async function POST(request: NextRequest) {
     const userId = user.id;
 
     const formData = await request.formData();
-    const file = formData.get("file") as File | null;
+    const fileValue = formData.get("file");
 
-    if (!file) {
+    if (!(fileValue instanceof File)) {
       return NextResponse.json({ error: "No file provided" }, { status: 400 });
     }
 
+    const file = fileValue;
+
     if (!ALLOWED_TYPES.has(file.type)) {
       return NextResponse.json(
-        { error: "Invalid file type. Allowed: jpeg, png, webp, gif" },
+        { error: "Invalid file type. Allowed: jpeg, png, webp" },
         { status: 400 },
       );
     }

apps/me/src/app/api/profile/positions/route.ts

@@ -20,7 +20,12 @@ export async function DELETE(request: NextRequest) {
       positionId: number;
     };
 
-    if (!body.orgId || !body.positionId) {
+    if (
+      body.orgId == null ||
+      typeof body.orgId !== "number" ||
+      body.positionId == null ||
+      typeof body.positionId !== "number"
+    ) {
       return NextResponse.json(
         { error: "orgId and positionId are required" },
         { status: 400 },

apps/me/src/app/api/profile/roles/route.ts

@@ -11,7 +11,11 @@ export async function DELETE(request: NextRequest) {
       roleName: string;
     };
 
-    if (!body.orgId || !body.roleName) {
+    if (
+      body.orgId == null ||
+      typeof body.orgId !== "number" ||
+      !body.roleName
+    ) {
       return NextResponse.json(
         { error: "orgId and roleName are required" },
         { status: 400 },

apps/me/src/lib/types.ts

@@ -61,7 +61,7 @@ export interface UserUpsert {
   phone?: string;
   homeRegionId?: number | null;
   avatarUrl?: string | null;
-  meta?: string;
+  meta?: Record<string, unknown>;
   emergencyContact?: string | null;
   emergencyPhone?: string | null;
   emergencyNotes?: string | null;