From 0078310f1a6010ff1cfe07ca9fd324be0b7a2174 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Sun, 2 Aug 2026 00:57:25 +0000
Subject: [PATCH] fix: address review comments

---
 functions/submit_order/handler.py | 9 ++++++---
 scripts/upload_menu.py            | 4 +++-
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/functions/submit_order/handler.py b/functions/submit_order/handler.py
index fe7bb75..5d688b1 100644
--- a/functions/submit_order/handler.py
+++ b/functions/submit_order/handler.py
@@ -231,11 +231,14 @@ def handle_publish_menu(event):
         body = json.loads(event.get("body", "{}"))
     except json.JSONDecodeError:
         return response(400, {"error": "Invalid JSON"})
-
+    
+    if not isinstance(body, dict):
+        return response(400, {"error": "Request body must be a JSON object"})
+    
     meals = body.get("meals")
     if not isinstance(meals, list) or not meals:
         return response(400, {"error": "At least one meal is required"})
-
+    
     for meal in meals:
         price = meal.get("price") if isinstance(meal, dict) else None
         if (
@@ -248,7 +251,7 @@ def handle_publish_menu(event):
             return response(
                 400, {"error": "Each meal requires a name and non-negative price"}
             )
-
+    
     week = current_week()
     menu = {
         "scraped_at": body.get("scraped_at"),
diff --git a/scripts/upload_menu.py b/scripts/upload_menu.py
index 4c851d2..15520f9 100644
--- a/scripts/upload_menu.py
+++ b/scripts/upload_menu.py
@@ -23,6 +23,8 @@ def signed_request(
     body: dict | None = None,
     region: str = "us-east-1",
 ) -> dict:
+    if not api_url.startswith(("http://", "https://")):
+        raise ValueError(f"api_url must use http(s) scheme: {api_url!r}")
     data = json.dumps(body).encode() if body is not None else None
     headers = {"Content-Type": "application/json"} if data is not None else {}
     request = AWSRequest(
@@ -37,7 +39,7 @@ def signed_request(
     SigV4Auth(credentials.get_frozen_credentials(), "execute-api", region).add_auth(
         request
     )
-
+    
     prepared = request.prepare()
     http_request = urllib.request.Request(
         prepared.url,