fix: satisfy sonar quality gate

src/Orbit.Api/Controllers/AiController.cs

@@ -1,3 +1,4 @@
+using System.Text.Json.Serialization;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Orbit.Api.Extensions;
@@ -144,7 +145,7 @@ await auditService.RecordAsync(new AgentAuditEntry(
 
     public record ConfirmPendingOperationResponse(Guid PendingOperationId, string ConfirmationToken, DateTime ExpiresAtUtc);
     public record StepUpChallengeRequest(string Language = "en");
-    public record VerifyStepUpRequest(Guid ChallengeId, string Code);
+    public record VerifyStepUpRequest([property: JsonRequired] Guid ChallengeId, string Code);
     public record ExecutePendingOperationRequest(string ConfirmationToken);
 
     [HttpPost("pending-operations/{id:guid}/confirm")]

src/Orbit.Api/Controllers/OAuthController.cs

@@ -28,6 +28,7 @@ public partial class OAuthController(
     IConfiguration configuration,
     ILogger<OAuthController> logger) : ControllerBase
 {
+    private const string InvalidRedirectUriError = "invalid_redirect_uri";
     private static readonly string[] SupportedResponseTypes = ["code"];
     private static readonly string[] SupportedGrantTypes = ["authorization_code"];
     private static readonly string[] SupportedCodeChallengeMethods = ["S256"];
@@ -107,7 +108,7 @@ public IActionResult Authorize(
             return BadRequest(new { error = "PKCE with S256 is required" });
 
         if (!IsRedirectUriAllowed(redirect_uri))
-            return BadRequest(new { error = "invalid_redirect_uri" });
+            return BadRequest(new { error = InvalidRedirectUriError });
 
         var googleClientId = googleSettings.Value.ClientId ?? "";
         var html = OAuthLoginPage.Render(
@@ -139,7 +140,7 @@ public record VerifyCodeRequest(
     public async Task<IActionResult> VerifyCode([FromBody] VerifyCodeRequest request, CancellationToken ct)
     {
         if (!IsRedirectUriAllowed(request.RedirectUri))
-            return BadRequest(new { error = "invalid_redirect_uri" });
+            return BadRequest(new { error = InvalidRedirectUriError });
 
         var result = await mediator.Send(
             new VerifyCodeCommand(request.Email, request.Code), ct);
@@ -166,7 +167,7 @@ public record GoogleAuthRequest(
     public async Task<IActionResult> GoogleAuth([FromBody] GoogleAuthRequest request, CancellationToken ct)
     {
         if (!IsRedirectUriAllowed(request.RedirectUri))
-            return BadRequest(new { error = "invalid_redirect_uri" });
+            return BadRequest(new { error = InvalidRedirectUriError });
 
         // Validate Google ID token directly (GIS returns a JWT, not a Supabase token)
         var client = httpClientFactory.CreateClient();
@@ -236,7 +237,7 @@ public async Task<IActionResult> Token(
             return BadRequest(new { error = "unsupported_grant_type" });
 
         if (!IsRedirectUriAllowed(redirect_uri))
-            return BadRequest(new { error = "invalid_redirect_uri" });
+            return BadRequest(new { error = InvalidRedirectUriError });
 
         var entry = authStore.ExchangeCode(code, code_verifier, redirect_uri);
         if (entry is null)