Fix watchlist add and thumbnail API validation

http_handler.py

@@ -242,15 +242,17 @@ class Handler(BaseHTTPRequestHandler):
                 self.json(actions[action](job_id))
             elif parsed.path in {"/api/watchlist", "/api/watchlist/add"}:
                 Handler._runtime(self)
-                self.json(Handler._context(self).add_to_watchlist(self.body_json()), HTTPStatus.CREATED)
+                result = Handler._context(self).add_to_watchlist(self.body_json())
+                status = HTTPStatus.CREATED if result.get("created") else HTTPStatus.OK
+                self.json(result, status)
             elif parsed.path == "/api/watchlist/ensure-thumbnails":
                 runtime = Handler._runtime(self)
-                payload = self.body_json()
+                payload = Handler.require_json_object(self, self.body_json())
                 self.json(
                     runtime["watchlist"].ensure_thumbnails(
-                        payload.get("show_ids") or [],
+                        Handler.optional_list_field(self, payload, "show_ids") or [],
                         limit=payload.get("limit", 6),
-                        force=bool(payload.get("force")),
+                        force=Handler.optional_bool_field(self, payload, "force", default=False),
                     )
                 )
             elif parsed.path == "/api/watchlist/update-status":
@@ -287,8 +289,7 @@ class Handler(BaseHTTPRequestHandler):
         self.json(context.get_config_snapshot())
 
     def require_fields(self, payload, *names):
-        if not isinstance(payload, dict):
-            raise ValueError("Expected a JSON object")
+        payload = Handler.require_json_object(self, payload)
         missing = [name for name in names if not str(payload.get(name) or "").strip()]
         if missing:
             if len(missing) == 1:
@@ -296,6 +297,35 @@ class Handler(BaseHTTPRequestHandler):
             raise ValueError(f"Missing required fields: {', '.join(missing)}")
         return payload
 
+    def require_json_object(self, payload):
+        if not isinstance(payload, dict):
+            raise ValueError("Expected a JSON object")
+        return payload
+
+    def optional_list_field(self, payload, name):
+        payload = Handler.require_json_object(self, payload)
+        if name not in payload or payload.get(name) is None:
+            return None
+        value = payload.get(name)
+        if not isinstance(value, list):
+            raise ValueError(f"Field '{name}' must be a JSON array")
+        return value
+
+    def optional_bool_field(self, payload, name, default=False):
+        payload = Handler.require_json_object(self, payload)
+        if name not in payload or payload.get(name) is None:
+            return default
+        value = payload.get(name)
+        if isinstance(value, bool):
+            return value
+        if isinstance(value, str):
+            normalized = value.strip().lower()
+            if normalized in {"1", "true", "yes", "on"}:
+                return True
+            if normalized in {"0", "false", "no", "off"}:
+                return False
+        raise ValueError(f"Field '{name}' must be a boolean")
+
     def body_json(self):
         try:
             length = int(self.headers.get("Content-Length", "0") or "0")