route.ts

Go to the documentation of this file.

/**
 * Example API Route Using Session Context
 * 
 * This demonstrates the proper pattern for creating API routes that:
 * 1. Check authentication from session
 * 2. Route to correct store URL based on session
 * 3. Handle different request types (openapi, gnap, elink)
 * 4. Enforce security: Retail stores can ONLY use ELINK
 */
 
import { NextRequest, NextResponse } from "next/server";
import { getRequestContext, validateStoreAccess, getStoreApiUrl, validateApiAccess } from "@/lib/server/sessionUtils";
import { FieldpineServerApi } from "@/lib/server/fieldpineApi";
 
/**
 * GET /api/v1/example-session
 * Example endpoint demonstrating session-based routing with security
 */
export async function GET(request: NextRequest) {
  try {
    // 1. Get session and store context
    const context = await getRequestContext(request);
    
    if (!context) {
      return NextResponse.json(
        { success: false, error: "Unauthorized - Please log in" },
        { status: 401 }
      );
    }
 
    // 2. SECURITY: Validate API access based on store type
    // Retail stores can ONLY use ELINK, management portal can use all
    const apiAccessValidation = validateApiAccess(context, 'elink');
    if (!apiAccessValidation.valid) {
      console.warn(`[API Security] Access denied: ${apiAccessValidation.error}`);
      return NextResponse.json(
        { 
          success: false, 
          error: apiAccessValidation.error,
          code: apiAccessValidation.errorCode
        },
        { status: 403 }
      );
    }
 
    // 3. Validate store type if needed (optional)
    // For example, if this endpoint only works in retail stores:
    const validation = validateStoreAccess(context, 'store');
    if (!validation.valid) {
      return NextResponse.json(
        { success: false, error: validation.error },
        { status: 403 }
      );
    }
 
    // 4. Get the appropriate API URL for the request type
    // Retail stores: ONLY 'elink' is allowed
    // Management portal: Can use 'openapi', 'gnap', or 'elink'
    const apiUrl = getStoreApiUrl(context, 'elink');
    
    // 5. Create Fieldpine API client with store-specific URL
    const api = new FieldpineServerApi(apiUrl);
    
    // 6. Make API calls using the session's API key
    // Example ELINK call
    const buckParams = {
      "3": "retailmax.elink.products",
      "9": "f501,0,test",
      "99": Math.random().toString()
    };
    const response = await api.buckApiCall(buckParams, context.session.apiKey);
 
    // 7. Return the data
    return NextResponse.json({
      success: true,
      data: response,
      meta: {
        store: context.store.name,
        storeType: context.store.type,
        apiUrl: apiUrl,
        user: context.session.username,
        allowedEndpoints: context.isRetailStore ? ['ELINK only'] : ['OpenAPI', 'GNAP', 'ELINK']
      }
    });
 
  } catch (error: any) {
    console.error("[Example Session API] Error:", error);
    return NextResponse.json(
      { success: false, error: error.message || "Internal server error" },
      { status: 500 }
    );
  }
}
 
/**
 * Example demonstrating management portal access to GNAP
 * This will be BLOCKED for retail stores
 */
export async function POST(request: NextRequest) {
  try {
    const context = await getRequestContext(request);
    
    if (!context) {
      return NextResponse.json(
        { success: false, error: "Unauthorized" },
        { status: 401 }
      );
    }
 
    // SECURITY: Validate GNAP access (retail stores will be BLOCKED)
    const apiAccessValidation = validateApiAccess(context, 'gnap');
    if (!apiAccessValidation.valid) {
      console.warn(`[API Security] GNAP access denied for retail store: ${context.store.name}`);
      return NextResponse.json(
        { 
          success: false, 
          error: apiAccessValidation.error,
          code: apiAccessValidation.errorCode,
          hint: 'GNAP endpoints are restricted to management portal only'
        },
        { status: 403 }
      );
    }
 
    // GNAP requests always go to IIG management portal
    const gnapUrl = getStoreApiUrl(context, 'gnap');
    const api = new FieldpineServerApi(gnapUrl);
    
    // Example BUCK call for reports
    const buckParams = {
      "3": "retailmax.report.sales",
      "9": "f110,4,today",
      "99": Math.random().toString()
    };
    
    const response = await api.buckApiCall(buckParams, context.session.apiKey);
 
    return NextResponse.json({
      success: true,
      data: response,
      meta: {
        requestType: 'gnap',
        apiUrl: gnapUrl,
        store: context.store.name,
        note: 'This endpoint is only accessible from management portal'
      }
    });
 
  } catch (error: any) {
    console.error("[Example GNAP API] Error:", error);
    return NextResponse.json(
      { success: false, error: error.message },
      { status: 500 }
    );
  }
}