MotorSignal-App/website/app/api/ops/users/route.ts

import { cookies } from 'next/headers';
import { NextRequest, NextResponse } from 'next/server';
import { hasValidOrigin } from '../../../../lib/request-origin';

export async function GET(request: NextRequest) {
  const cookieStore = await cookies();
  const isProduction = process.env.NODE_ENV === 'production' && process.env.NEXT_PUBLIC_APP_ENV === 'production';
  const opsToken = isProduction
    ? cookieStore.get('__Host-motorsignal_ops')?.value
    : cookieStore.get('__Host-motorsignal_ops')?.value ??
      cookieStore.get('motorsignal_ops')?.value;

  if (!opsToken) {
    return NextResponse.json(
      { detail: 'Authentication required.' },
      { status: 401 }
    );
  }

  const searchParams = request.nextUrl.searchParams;
  const q = searchParams.get('q');
  const cursor = searchParams.get('cursor');
  const limit = searchParams.get('limit');
  const statusFilter = searchParams.get('status_filter');
  const verifiedFilter = searchParams.get('verified_filter');

  const baseUrl = process.env.MOTORSIGNAL_API_BASE_URL ?? 'https://api.motorsignal.app';
  const targetUrl = new URL(`${baseUrl}/api/v1/ops/users`);
  if (q) targetUrl.searchParams.set('q', q);
  if (cursor) targetUrl.searchParams.set('cursor', cursor);
  if (limit) targetUrl.searchParams.set('limit', limit);
  if (statusFilter) targetUrl.searchParams.set('status_filter', statusFilter);
  if (verifiedFilter) targetUrl.searchParams.set('verified_filter', verifiedFilter);

  try {
    const response = await fetch(targetUrl.toString(), {
      method: 'GET',
      headers: {
        authorization: `Bearer ${opsToken}`,
        accept: 'application/json',
      },
      cache: 'no-store',
    });

    if (response.status === 401) {
      return NextResponse.json(
        { detail: 'Your Operations session has expired.' },
        { status: 401 }
      );
    }
    if (response.status === 403) {
      return NextResponse.json(
        { detail: 'You do not have authority to view Users.' },
        { status: 403 }
      );
    }
    if (!response.ok) {
      return NextResponse.json(
        { detail: 'Operations is temporarily unavailable.' },
        { status: response.status >= 500 ? response.status : 503 }
      );
    }

    const data = await response.json();
    return NextResponse.json(data);
  } catch {
    return NextResponse.json(
      { detail: 'Unable to connect to Operations platform.' },
      { status: 503 }
    );
  }
}

export async function POST(request: NextRequest) {
  if (!hasValidOrigin(request)) {
    return NextResponse.json({ detail: 'Invalid request origin.' }, { status: 403 });
  }

  const cookieStore = await cookies();
  const isProduction = process.env.NODE_ENV === 'production' && process.env.NEXT_PUBLIC_APP_ENV === 'production';
  const opsToken = isProduction
    ? cookieStore.get('__Host-motorsignal_ops')?.value
    : cookieStore.get('__Host-motorsignal_ops')?.value ??
      cookieStore.get('motorsignal_ops')?.value;

  if (!opsToken) {
    return NextResponse.json(
      { detail: 'Authentication required.' },
      { status: 401 }
    );
  }

  let body: unknown;
  try {
    body = await request.json();
  } catch {
    return NextResponse.json(
      { detail: 'Invalid request body.' },
      { status: 422 }
    );
  }

  const baseUrl = process.env.MOTORSIGNAL_API_BASE_URL ?? 'https://api.motorsignal.app';
  try {
    const response = await fetch(`${baseUrl}/api/v1/ops/users`, {
      method: 'POST',
      headers: {
        authorization: `Bearer ${opsToken}`,
        'content-type': 'application/json',
        accept: 'application/json',
      },
      body: JSON.stringify(body),
      cache: 'no-store',
    });

    if (response.status === 401) {
      return NextResponse.json(
        { detail: 'Your Operations session has expired.' },
        { status: 401 }
      );
    }
    if (response.status === 403) {
      return NextResponse.json(
        { detail: 'You do not have authority to create users.' },
        { status: 403 }
      );
    }
    if (response.status === 409) {
      const data = await response.json().catch(() => null);
      return NextResponse.json(
        { detail: data?.detail ?? 'User with this email already exists.' },
        { status: 409 }
      );
    }
    if (response.status === 422) {
      const data = await response.json().catch(() => null);
      return NextResponse.json(
        { detail: data?.detail ?? 'Invalid user fields.' },
        { status: 422 }
      );
    }
    if (!response.ok) {
      return NextResponse.json(
        { detail: 'Operations is temporarily unavailable.' },
        { status: response.status >= 500 ? response.status : 503 }
      );
    }

    const data = await response.json();
    return NextResponse.json(data, { status: 201 });
  } catch {
    return NextResponse.json(
      { detail: 'Unable to connect to Operations platform.' },
      { status: 503 }
    );
  }
}