u

src/api/routes/company.js

@@ -15,6 +15,12 @@ function parseCompanyBody(body) {
     if (!iso639 || !name || taxrate == null || reducedtaxrate == null) {
         return { error: 'iso639, name, taxrate, and reducedtaxrate are required' };
     }
+    if (typeof taxrate !== 'number' || !Number.isFinite(taxrate) || taxrate < 0) {
+        return { error: 'taxrate must be a non-negative number' };
+    }
+    if (typeof reducedtaxrate !== 'number' || !Number.isFinite(reducedtaxrate) || reducedtaxrate < 0) {
+        return { error: 'reducedtaxrate must be a non-negative number' };
+    }
     return { iso639, name, taxrate, reducedtaxrate };
 }
 
@@ -29,6 +35,7 @@ function parseCompanyId(id) {
 function companyErrorStatus(error) {
     if (error.message === 'Company not found') return 404;
     if (error.message === 'Company name not available') return 409;
+    if (error.message === 'Invalid tax rate') return 400;
     return 500;
 }