Harden queue worker crashes and POST validation

http_handler.py

@@ -255,11 +255,11 @@ class Handler(BaseHTTPRequestHandler):
                 )
             elif parsed.path == "/api/watchlist/update-status":
                 Handler._runtime(self)
-                payload = self.body_json()
+                payload = Handler.require_fields(self, self.body_json(), "show_id")
                 self.json(Handler._context(self).update_watchlist_status(payload["show_id"], payload.get("mode")))
             elif parsed.path == "/api/watchlist/update-category":
                 Handler._runtime(self)
-                payload = self.body_json()
+                payload = Handler.require_fields(self, self.body_json(), "show_id")
                 self.json(Handler._context(self).update_watchlist_category(payload["show_id"], payload.get("category")))
             elif parsed.path == "/api/watchlist/update-all":
                 Handler._runtime(self)
@@ -268,11 +268,11 @@ class Handler(BaseHTTPRequestHandler):
                 self.json(result, status)
             elif parsed.path == "/api/watchlist/remove":
                 Handler._runtime(self)
-                payload = self.body_json()
+                payload = Handler.require_fields(self, self.body_json(), "show_id")
                 self.json(Handler._context(self).remove_from_watchlist(payload["show_id"]))
             elif parsed.path == "/api/watchlist/upload-thumbnail":
                 Handler._runtime(self)
-                payload = self.body_json()
+                payload = Handler.require_fields(self, self.body_json(), "show_id", "data_url")
                 self.json(Handler._context(self).upload_watchlist_thumbnail(payload))
             else:
                 self.error(HTTPStatus.NOT_FOUND, "Not found")
@@ -286,6 +286,16 @@ class Handler(BaseHTTPRequestHandler):
         context.save_runtime_config(config)
         self.json(context.get_config_snapshot())
 
+    def require_fields(self, payload, *names):
+        if not isinstance(payload, dict):
+            raise ValueError("Expected a JSON object")
+        missing = [name for name in names if not str(payload.get(name) or "").strip()]
+        if missing:
+            if len(missing) == 1:
+                raise ValueError(f"Missing required field: {missing[0]}")
+            raise ValueError(f"Missing required fields: {', '.join(missing)}")
+        return payload
+
     def body_json(self):
         try:
             length = int(self.headers.get("Content-Length", "0") or "0")