route.ts

Go to the documentation of this file.

import { NextRequest, NextResponse } from 'next/server';
import { fieldpineServerApi } from '@/lib/server/fieldpineApi';
import { getRequestContext, validateApiAccess } from '@/lib/server/sessionUtils';
 
/**
 * Products Endpoint (ELINK API)
 * GET /api/v1/openapi/products
 * 
 * Uses Fieldpine's ELINK API (retailmax.elink.products.list)
 * Security: Retail stores can access this (ELINK only)
 */
export async function GET(request: NextRequest) {
  try {
    // 1. Get session and store context
    const context = await getRequestContext(request);
    
    if (!context || !context.isAuthenticated) {
      return NextResponse.json(
        { error: 'Authentication required' },
        { status: 401 }
      );
    }
 
    // 2. SECURITY: Validate ELINK access
    const apiAccessValidation = validateApiAccess(context, 'elink');
    if (!apiAccessValidation.valid) {
      console.warn(`[API Security] ELINK access denied: ${apiAccessValidation.error}`);
      return NextResponse.json(
        { 
          error: apiAccessValidation.error,
          code: apiAccessValidation.errorCode
        },
        { status: 403 }
      );
    }
 
    // 3. Rate limiting
    const clientId = request.headers.get('x-forwarded-for') || 
                    request.headers.get('x-real-ip') || 
                    context.session.userId || 
                    'unknown';
    if (!fieldpineServerApi.checkClientRateLimit(clientId)) {
      return NextResponse.json(
        { error: 'Rate limit exceeded' },
        { status: 429 }
      );
    }
 
    // 4. Parse query parameters
    const { searchParams } = new URL(request.url);
    const search = searchParams.get('search') || searchParams.get('EnglishQuery');
    const plu = searchParams.get('plu');
    const barcode = searchParams.get('barcode');
    const limit = searchParams.get('limit') || searchParams.get('$top') || '50';
    const skip = searchParams.get('skip') || searchParams.get('$skip');
    const filter = searchParams.get('filter') || searchParams.get('$filter');
    
    console.log(`[Products API] Search params:`, { search, plu, barcode, limit, skip, filter });
 
    // 5. Build ELINK BUCK parameters
    const buckParams: Record<string, string | string[]> = {
      "3": "retailmax.elink.products.list",
      "8": limit,
      "99": Math.random().toString() // Cache buster
    };
 
    // Add search filters
    // Field reference: f105=barcode, f102=PLU, f101=name/description, f100=product ID
    if (barcode) {
      buckParams["9"] = `f105,8,${encodeURIComponent(barcode)}`;
    } else if (plu) {
      buckParams["9"] = `f102,0,${encodeURIComponent(plu)}`;
    } else if (search) {
      buckParams["9"] = `f101,8,${encodeURIComponent(search)}`;
    } else if (filter) {
      // Handle OData-style filters if needed
      buckParams["9"] = filter;
    }
 
    // 6. Make ELINK API call using singleton
    console.log(`[Products API] Session data:`, {
      hasApiKey: !!context.session.apiKey,
      apiKeyLength: context.session.apiKey?.length,
      storeUrl: context.store.url,
      userId: context.session.userId
    });
    
    if (!context.session.apiKey) {
      console.error('[Products API] No API key in session!');
      return NextResponse.json(
        { error: 'Session expired or invalid. Please log in again.' },
        { status: 401 }
      );
    }
    
    // Use store-specific URL for API calls
    const buckResponse = await fieldpineServerApi.buckApiCall(
      buckParams, 
      context.session.apiKey,
      context.store.url
    );
    
    // 7. Transform BUCK response to OData format
    if (buckResponse && buckResponse.RootType === "ARAY") {
      let products: any[] = [];
      
      if (buckResponse.DATS && Array.isArray(buckResponse.DATS)) {
        products = buckResponse.DATS.map((item: any) => ({
          Pid: item.f100,
          Name: item.f101 || item.f500,
          Description: item.f500,
          Barcode: item.f105,
          SecondaryBarcode: item.f501,
          PLU: item.f102,
          SellPrice: item.f103,
          Price: item.f103,
          LastCost: item.f108,
          Cost: item.f150,
          CostPrice: item.f150,
          StockLevel: item.f130 || 0,
          StockMin: item.f131,
          Depid: item.f106,
          Department: item.f106,
          Department2: item.f350,
          Department3: item.f351,
          Department4: item.f352,
          SupplierId: item.f104,
          ManufacturerCode: item.f506,
          MfrCode: item.f506,
        }));
      }
 
      return NextResponse.json({ 
        success: true, 
        data: {
          value: products,
          '@odata.count': products.length
        },
        source: 'elink'
      });
    }
 
    // Empty or unexpected BUCK response
    return NextResponse.json({ 
      success: true, 
      data: { 
        value: [], 
        '@odata.count': 0 
      },
      source: 'elink'
    });
 
  } catch (error: any) {
    console.error('[Products API] Error:', error);
    
    // Check if it's a 403/authentication error
    if (error.message && error.message.includes('403')) {
      return NextResponse.json(
        { 
          error: 'Your session has expired. Please refresh the page and log in again.',
          code: 'SESSION_EXPIRED'
        },
        { status: 401 }
      );
    }
    
    return NextResponse.json(
      { error: error.message || 'Failed to fetch products' },
      { status: 500 }
    );
  }
}