test: add malformed/non-object body tests for assets, employees, requests

Closes the coverage gap noted in CLAUDE.md's "Việc còn dở" — mirrors the
existing pattern in tests/licenses.test.ts and tests/assignments.test.ts for
POST /api/assets, POST /api/employees, POST /api/requests (the only body-
accepting methods on these three routes; none have a PATCH route yet).

tests/assets.test.ts

@@ -297,6 +297,30 @@ describe("POST /api/assets", () => {
     const remaining = await prisma.assetItem.findMany();
     expect(remaining).toHaveLength(0);
   });
+
+  it("rejects an invalid JSON body", async () => {
+    const req = new Request("http://localhost/api/assets", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: "not json",
+    });
+
+    const res = await POST(req);
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toMatch(/JSON/i);
+  });
+
+  it("rejects a non-object JSON body", async () => {
+    // Note: arrays are `typeof "object"` in JS, so they pass the route's
+    // object check — use a JSON string primitive here to actually exercise
+    // the "not an object" branch (mirrors tests/licenses.test.ts).
+    const res = await POST(postRequest("not an object"));
+
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toMatch(/JSON object/i);
+  });
 });
 
 describe("GET /api/assets", () => {

tests/employees.test.ts

@@ -125,6 +125,30 @@ describe("POST /api/employees", () => {
     });
     expect(updated.managerId).toBe(created.id);
   });
+
+  it("rejects an invalid JSON body", async () => {
+    const req = new Request("http://localhost/api/employees", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: "not json",
+    });
+
+    const res = await POST(req);
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toMatch(/JSON/i);
+  });
+
+  it("rejects a non-object JSON body", async () => {
+    // Note: arrays are `typeof "object"` in JS, so they pass the route's
+    // object check — use a JSON string primitive here to actually exercise
+    // the "not an object" branch (mirrors tests/licenses.test.ts).
+    const res = await POST(postRequest("not an object"));
+
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toMatch(/JSON object/i);
+  });
 });
 
 describe("GET /api/employees", () => {

tests/requests.test.ts

@@ -239,6 +239,30 @@ describe("POST /api/requests", () => {
     const body = await res.json();
     expect(body.error).toMatch(/purchase_order_id/i);
   });
+
+  it("rejects an invalid JSON body", async () => {
+    const req = new Request("http://localhost/api/requests", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: "not json",
+    });
+
+    const res = await POST(req);
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toMatch(/JSON/i);
+  });
+
+  it("rejects a non-object JSON body", async () => {
+    // Note: arrays are `typeof "object"` in JS, so they pass the route's
+    // object check — use a JSON string primitive here to actually exercise
+    // the "not an object" branch (mirrors tests/licenses.test.ts).
+    const res = await POST(postRequest("not an object"));
+
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toMatch(/JSON object/i);
+  });
 });
 
 describe("GET /api/requests", () => {