fix: address review comments

functions/submit_order/handler.py

@@ -236,11 +236,14 @@ def handle_publish_menu(event):
         body = json.loads(event.get("body", "{}"))
     except json.JSONDecodeError:
         return response(400, {"error": "Invalid JSON"})
-
+    
+    if not isinstance(body, dict):
+        return response(400, {"error": "Request body must be a JSON object"})
+    
     meals = body.get("meals")
     if not isinstance(meals, list) or not meals:
         return response(400, {"error": "At least one meal is required"})
-
+    
     for meal in meals:
         price = meal.get("price") if isinstance(meal, dict) else None
         if (
@@ -253,7 +256,7 @@ def handle_publish_menu(event):
             return response(
                 400, {"error": "Each meal requires a name and non-negative price"}
             )
-
+    
     week = current_week()
     menu = {
         "scraped_at": body.get("scraped_at"),

scripts/upload_menu.py

@@ -23,6 +23,8 @@ def signed_request(
     body: dict | None = None,
     region: str = "us-east-1",
 ) -> dict:
+    if not api_url.startswith(("http://", "https://")):
+        raise ValueError(f"api_url must use http(s) scheme: {api_url!r}")
     data = json.dumps(body).encode() if body is not None else None
     headers = {"Content-Type": "application/json"} if data is not None else {}
     request = AWSRequest(
@@ -37,7 +39,7 @@ def signed_request(
     SigV4Auth(credentials.get_frozen_credentials(), "execute-api", region).add_auth(
         request
     )
-
+    
     prepared = request.prepare()
     http_request = urllib.request.Request(
         prepared.url,