MotorSignal-App/website/app/api/ops/incidents/[caseRef]/route.ts

import { cookies } from 'next/headers';
import { NextRequest, NextResponse } from 'next/server';
import { sanitizeIncidentDetail } from '../../../../../lib/ops-data';
import { hasValidOrigin } from '../../../../../lib/request-origin';

interface RouteContext {
  params: Promise<{
    caseRef: string;
  }>;
}

export async function GET(request: NextRequest, context: RouteContext) {
  const cookieStore = await cookies();
  const isProduction = process.env.NODE_ENV === 'production' && process.env.NEXT_PUBLIC_APP_ENV === 'production';
  const opsToken = isProduction
    ? cookieStore.get('__Host-motorsignal_ops')?.value
    : cookieStore.get('__Host-motorsignal_ops')?.value ??
      cookieStore.get('motorsignal_ops')?.value;

  if (!opsToken) {
    return NextResponse.json(
      { detail: 'Authentication required.' },
      { status: 401 }
    );
  }

  const { caseRef } = await context.params;
  const baseUrl = process.env.MOTORSIGNAL_API_BASE_URL ?? 'https://api.motorsignal.app';

  try {
    const response = await fetch(`${baseUrl}/api/v1/ops/incidents/${encodeURIComponent(caseRef)}`, {
      method: 'GET',
      headers: {
        authorization: `Bearer ${opsToken}`,
        accept: 'application/json',
      },
      cache: 'no-store',
    });

    if (response.status === 401) {
      return NextResponse.json(
        { detail: 'Your Operations session has expired.' },
        { status: 401 }
      );
    }
    if (response.status === 403) {
      return NextResponse.json(
        { detail: 'You do not have authority to view this Incident.' },
        { status: 403 }
      );
    }
    if (response.status === 404) {
      return NextResponse.json(
        { detail: 'Incident not found.' },
        { status: 404 }
      );
    }
    if (!response.ok) {
      return NextResponse.json(
        { detail: 'Operations is temporarily unavailable.' },
        { status: response.status >= 500 ? response.status : 503 }
      );
    }

    const data = await response.json();
    const sanitized = sanitizeIncidentDetail(data);
    if (!sanitized) {
      return NextResponse.json(
        { detail: 'Invalid incident response from backend.' },
        { status: 502 }
      );
    }

    return NextResponse.json(sanitized);
  } catch {
    return NextResponse.json(
      { detail: 'Unable to connect to Operations platform.' },
      { status: 503 }
    );
  }
}

export async function PATCH(request: NextRequest, context: RouteContext) {
  if (!hasValidOrigin(request)) {
    return NextResponse.json({ detail: 'Invalid request origin.' }, { status: 403 });
  }

  const cookieStore = await cookies();
  const isProduction = process.env.NODE_ENV === 'production' && process.env.NEXT_PUBLIC_APP_ENV === 'production';
  const opsToken = isProduction
    ? cookieStore.get('__Host-motorsignal_ops')?.value
    : cookieStore.get('__Host-motorsignal_ops')?.value ??
      cookieStore.get('motorsignal_ops')?.value;

  if (!opsToken) {
    return NextResponse.json(
      { detail: 'Authentication required.' },
      { status: 401 }
    );
  }

  const { caseRef } = await context.params;
  let body: unknown;
  try {
    body = await request.json();
  } catch {
    return NextResponse.json(
      { detail: 'Invalid request body.' },
      { status: 422 }
    );
  }

  const baseUrl = process.env.MOTORSIGNAL_API_BASE_URL ?? 'https://api.motorsignal.app';

  try {
    const response = await fetch(`${baseUrl}/api/v1/ops/incidents/${encodeURIComponent(caseRef)}`, {
      method: 'PATCH',
      headers: {
        authorization: `Bearer ${opsToken}`,
        'content-type': 'application/json',
        accept: 'application/json',
      },
      body: JSON.stringify(body),
      cache: 'no-store',
    });

    if (response.status === 401) {
      return NextResponse.json(
        { detail: 'Your Operations session has expired.' },
        { status: 401 }
      );
    }
    if (response.status === 403) {
      const data = await response.json().catch(() => null);
      return NextResponse.json(
        { detail: data?.detail ?? 'You do not have authority for this action.' },
        { status: 403 }
      );
    }
    if (response.status === 404) {
      return NextResponse.json(
        { detail: 'Incident not found.' },
        { status: 404 }
      );
    }
    if (response.status === 409) {
      const data = await response.json().catch(() => null);
      return NextResponse.json(
        { detail: data?.detail ?? 'That status transition is not permitted.' },
        { status: 409 }
      );
    }
    if (response.status === 422) {
      const data = await response.json().catch(() => null);
      return NextResponse.json(
        { detail: data?.detail ?? 'Review the incident fields and try again.' },
        { status: 422 }
      );
    }
    if (!response.ok) {
      return NextResponse.json(
        { detail: 'Operations is temporarily unavailable.' },
        { status: response.status >= 500 ? response.status : 503 }
      );
    }

    const data = await response.json();
    const sanitized = sanitizeIncidentDetail(data);
    return NextResponse.json(sanitized ?? data);
  } catch {
    return NextResponse.json(
      { detail: 'Unable to connect to Operations platform.' },
      { status: 503 }
    );
  }
}