From 3d84e4e77bf75accb312d5f43175e8205f5e5902 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carl-Gerhard=20Lindesva=CC=88rd?= <lindesvard@gmail.com>
Date: Thu, 26 Feb 2026 15:29:19 +0100
Subject: [PATCH] fix: ensure we have a body before check type

---
 apps/api/src/hooks/duplicate.hook.ts | 29 +++++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/apps/api/src/hooks/duplicate.hook.ts b/apps/api/src/hooks/duplicate.hook.ts
index 7b7655b5..15421172 100644
--- a/apps/api/src/hooks/duplicate.hook.ts
+++ b/apps/api/src/hooks/duplicate.hook.ts
@@ -14,14 +14,15 @@ export async function duplicateHook(
   const ip = req.clientIp;
   const origin = req.headers.origin;
   const clientId = req.headers['openpanel-client-id'];
-  const isReplay = 'type' in req.body && req.body.type === 'replay';
+  const body = req?.body;
+  const isTrackPayload = getIsTrackPayload(req);
+  const isReplay = isTrackPayload && req.body.type === 'replay';
   const shouldCheck = ip && origin && clientId && !isReplay;
-
   const isDuplicate = shouldCheck
     ? await isDuplicatedEvent({
         ip,
         origin,
-        payload: req.body,
+        payload: body,
         projectId: clientId as string,
       })
     : false;
@@ -30,3 +31,25 @@ export async function duplicateHook(
     return reply.status(200).send('Duplicate event');
   }
 }
+
+function getIsTrackPayload(
+  req: FastifyRequest<{
+    Body: ITrackHandlerPayload | DeprecatedPostEventPayload;
+  }>
+): req is FastifyRequest<{
+  Body: ITrackHandlerPayload;
+}> {
+  if (req.method !== 'POST') {
+    return false;
+  }
+
+  if (!req.body) {
+    return false;
+  }
+
+  if (typeof req.body !== 'object' || Array.isArray(req.body)) {
+    return false;
+  }
+
+  return 'type' in req.body;
+}