MotorSignal-App/website/app/api/ops/incidents/route.ts

import { cookies } from 'next/headers';
import { NextRequest, NextResponse } from 'next/server';
import { sanitizeIncidentSummary } from '../../../../lib/ops-data';
import { hasValidOrigin } from '../../../../lib/request-origin';
import { SafeIncidentSummary } from '../../../../components/ops/types';

export async function GET(request: NextRequest) {
  const cookieStore = await cookies();
  const isProduction = process.env.NODE_ENV === 'production' && process.env.NEXT_PUBLIC_APP_ENV === 'production';
  const opsToken = isProduction
    ? cookieStore.get('__Host-motorsignal_ops')?.value
    : cookieStore.get('__Host-motorsignal_ops')?.value ??
      cookieStore.get('motorsignal_ops')?.value;

  if (!opsToken) {
    return NextResponse.json(
      { detail: 'Authentication required.' },
      { status: 401 }
    );
  }

  const searchParams = request.nextUrl.searchParams;
  const status = searchParams.get('status');
  const severity = searchParams.get('severity');
  const caseRef = searchParams.get('case_reference');
  const cursor = searchParams.get('cursor');

  const baseUrl = process.env.MOTORSIGNAL_API_BASE_URL ?? 'https://api.motorsignal.app';
  const targetUrl = new URL(`${baseUrl}/api/v1/ops/incidents`);
  if (status) targetUrl.searchParams.set('status', status);
  if (severity) targetUrl.searchParams.set('severity', severity);
  if (caseRef) targetUrl.searchParams.set('case_reference', caseRef);
  if (cursor) targetUrl.searchParams.set('cursor', cursor);

  try {
    const response = await fetch(targetUrl.toString(), {
      method: 'GET',
      headers: {
        authorization: `Bearer ${opsToken}`,
        accept: 'application/json',
      },
      cache: 'no-store',
    });

    if (response.status === 401) {
      return NextResponse.json(
        { detail: 'Your Operations session has expired.' },
        { status: 401 }
      );
    }
    if (response.status === 403) {
      return NextResponse.json(
        { detail: 'You do not have authority to view Incidents.' },
        { status: 403 }
      );
    }
    if (!response.ok) {
      return NextResponse.json(
        { detail: 'Operations is temporarily unavailable.' },
        { status: response.status >= 500 ? response.status : 503 }
      );
    }

    const data = await response.json();
    const rawItems = Array.isArray(data?.items) ? data.items : [];
    const items: SafeIncidentSummary[] = rawItems
      .map(sanitizeIncidentSummary)
      .filter((i: SafeIncidentSummary | null): i is SafeIncidentSummary => i !== null);

    return NextResponse.json({
      items,
      next_cursor: data?.next_cursor ?? null,
    });
  } catch {
    return NextResponse.json(
      { detail: 'Unable to connect to Operations platform.' },
      { status: 503 }
    );
  }
}

export async function POST(request: NextRequest) {
  if (!hasValidOrigin(request)) {
    return NextResponse.json({ detail: 'Invalid request origin.' }, { status: 403 });
  }

  const cookieStore = await cookies();
  const isProduction = process.env.NODE_ENV === 'production' && process.env.NEXT_PUBLIC_APP_ENV === 'production';
  const opsToken = isProduction
    ? cookieStore.get('__Host-motorsignal_ops')?.value
    : cookieStore.get('__Host-motorsignal_ops')?.value ??
      cookieStore.get('motorsignal_ops')?.value;

  if (!opsToken) {
    return NextResponse.json(
      { detail: 'Authentication required.' },
      { status: 401 }
    );
  }

  let body: unknown;
  try {
    body = await request.json();
  } catch {
    return NextResponse.json(
      { detail: 'Invalid request body.' },
      { status: 422 }
    );
  }

  const baseUrl = process.env.MOTORSIGNAL_API_BASE_URL ?? 'https://api.motorsignal.app';
  try {
    const response = await fetch(`${baseUrl}/api/v1/ops/incidents`, {
      method: 'POST',
      headers: {
        authorization: `Bearer ${opsToken}`,
        'content-type': 'application/json',
        accept: 'application/json',
      },
      body: JSON.stringify(body),
      cache: 'no-store',
    });

    if (response.status === 401) {
      return NextResponse.json(
        { detail: 'Your Operations session has expired.' },
        { status: 401 }
      );
    }
    if (response.status === 403) {
      return NextResponse.json(
        { detail: 'You do not have authority to create Incidents.' },
        { status: 403 }
      );
    }
    if (response.status === 422) {
      const data = await response.json().catch(() => null);
      return NextResponse.json(
        { detail: data?.detail ?? 'Invalid incident fields.' },
        { status: 422 }
      );
    }
    if (!response.ok) {
      return NextResponse.json(
        { detail: 'Operations is temporarily unavailable.' },
        { status: response.status >= 500 ? response.status : 503 }
      );
    }

    const data = await response.json();
    return NextResponse.json(data, { status: 201 });
  } catch {
    return NextResponse.json(
      { detail: 'Unable to connect to Operations platform.' },
      { status: 503 }
    );
  }
}