Jakob Wennberg
ec27228a8e
Em dashes (—) and en dashes (–) had spread across comments, docs, tests, and a few UI strings, reading as AI-generated boilerplate rather than house style. Replaced each with punctuation matching its context: colon for explanatory clauses, comma for asides, plain hyphen for numeric/legal ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for paired-dash asides. messages/en.json and messages/sv.json were fixed by hand together to keep sv/en in sync. Left untouched where the dash is the functional subject rather than decorative punctuation: date-range-parser.ts's separator regex, charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the agent system-prompt files that already instruct against em dashes, and a golden iXBRL test fixture compared byte-for-byte. Also fixes two bugs surfaced along the way: an off-by-one in ApiKeysPanel's scope-label split (a leftover from an earlier partial pass), and a charset-repair test that had lost the literal en-dash it exists to verify. Regenerated the agent atom seed migration (skills:generate) since 27 SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes, with an explicit carve-out for the functional-dash cases above. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
94 lines
3.3 KiB
TypeScript
94 lines
3.3 KiB
TypeScript
import { createClient } from '@/lib/supabase/server'
|
|
import { NextResponse } from 'next/server'
|
|
import { extractBearerToken, validateApiKey, createServiceClientNoCookies } from '@/lib/auth/api-keys'
|
|
import { validateQuery } from '@/lib/api/validate'
|
|
import { EventsQuerySchema } from '@/lib/api/schemas'
|
|
import { requireCompanyId } from '@/lib/company/context'
|
|
import type { SupabaseClient } from '@supabase/supabase-js'
|
|
|
|
/**
|
|
* GET /api/events
|
|
*
|
|
* Cursor-based polling endpoint for external automation platforms (n8n, Make, Zapier).
|
|
* Returns events from the event_log table in sequence order.
|
|
*
|
|
* Query params:
|
|
* - after (bigint, optional): return events with sequence > this value
|
|
* - types (string, optional): comma-separated event type filter
|
|
* - limit (int, optional): max results, default 50, cap 100
|
|
*
|
|
* Supports both session auth (browser) and API key auth (automation platforms).
|
|
*/
|
|
export async function GET(request: Request) {
|
|
// Dual auth: API key or session
|
|
let userId: string
|
|
let supabase: SupabaseClient
|
|
// When authenticated via an API key, the key is BOUND to a specific company.
|
|
// Honor that binding (least privilege) rather than resolving the user's
|
|
// active company: otherwise a key scoped to company A would leak company B's
|
|
// events whenever the user's active_company_id happened to point elsewhere.
|
|
let keyCompanyId: string | null = null
|
|
|
|
const token = extractBearerToken(request)
|
|
if (token?.startsWith('gnubok_sk_')) {
|
|
const authResult = await validateApiKey(token)
|
|
if ('error' in authResult) {
|
|
return NextResponse.json({ error: authResult.error }, { status: authResult.status })
|
|
}
|
|
userId = authResult.userId
|
|
keyCompanyId = authResult.companyId
|
|
supabase = createServiceClientNoCookies()
|
|
} else {
|
|
supabase = await createClient()
|
|
const { data: { user } } = await supabase.auth.getUser()
|
|
if (!user) {
|
|
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
|
}
|
|
userId = user.id
|
|
}
|
|
|
|
// Session auth resolves the active company; API-key auth uses the key's bound company.
|
|
const companyId = keyCompanyId ?? await requireCompanyId(supabase, userId)
|
|
// Defense in depth: never run the event_log query with an empty/undefined
|
|
// scope. requireCompanyId throws when there is no company, but guard the
|
|
// key-bound path too so a malformed binding can't widen the query scope.
|
|
if (!companyId) {
|
|
return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
|
|
}
|
|
|
|
// Validate query params
|
|
const result = validateQuery(request, EventsQuerySchema)
|
|
if (!result.success) return result.response
|
|
const { after, types, limit } = result.data
|
|
|
|
// Build query
|
|
let query = supabase
|
|
.from('event_log')
|
|
.select('sequence, event_type, entity_id, data, created_at')
|
|
.eq('company_id', companyId)
|
|
.order('sequence', { ascending: true })
|
|
.limit(limit)
|
|
|
|
if (after !== undefined) {
|
|
query = query.gt('sequence', after)
|
|
}
|
|
|
|
if (types && types.length > 0) {
|
|
query = query.in('event_type', types)
|
|
}
|
|
|
|
const { data, error } = await query
|
|
|
|
if (error) {
|
|
return NextResponse.json({ error: error.message }, { status: 500 })
|
|
}
|
|
|
|
const events = data ?? []
|
|
|
|
return NextResponse.json({
|
|
data: events,
|
|
cursor: events.length > 0 ? events[events.length - 1].sequence : (after ?? 0),
|
|
has_more: events.length === limit,
|
|
})
|
|
}
|