Hartmut
9e31c6d972
- public-holidays cron: replace fail-open inline auth check with verifyCronSecret (was open to unauthenticated access when CRON_SECRET unset) - /api/perf: replace timing-unsafe string comparison with verifyCronSecret - /api/health: strip baseUrl and latency fields from response to avoid leaking infrastructure details (NEXTAUTH_URL config, internal timings) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
55 lines
1.7 KiB
TypeScript
55 lines
1.7 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { prisma } from "@capakraken/db";
|
|
import { autoImportPublicHolidays } from "@capakraken/api";
|
|
import { logger } from "@capakraken/api/lib/logger";
|
|
import { verifyCronSecret } from "~/lib/cron-auth.js";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
export const runtime = "nodejs";
|
|
|
|
/**
|
|
* GET /api/cron/public-holidays?year=2027
|
|
*
|
|
* Auto-imports public holidays for all active resources for a given year.
|
|
* Each resource's federal state determines which state-specific holidays apply.
|
|
* Duplicate-safe: existing holidays are skipped.
|
|
*
|
|
* Query params:
|
|
* - year (optional): defaults to next year
|
|
*
|
|
* Protected with CRON_SECRET via `Authorization: Bearer <secret>` header.
|
|
*/
|
|
export async function GET(request: Request) {
|
|
const deny = verifyCronSecret(request);
|
|
if (deny) return deny;
|
|
|
|
const { searchParams } = new URL(request.url);
|
|
const yearParam = searchParams.get("year");
|
|
const year = yearParam ? parseInt(yearParam, 10) : new Date().getFullYear() + 1;
|
|
|
|
if (isNaN(year) || year < 2000 || year > 2100) {
|
|
return NextResponse.json(
|
|
{ error: "Invalid year parameter. Must be between 2000 and 2100." },
|
|
{ status: 400 },
|
|
);
|
|
}
|
|
|
|
try {
|
|
const result = await autoImportPublicHolidays(prisma, year);
|
|
|
|
return NextResponse.json({
|
|
ok: true,
|
|
year: result.year,
|
|
holidaysCreated: result.holidaysCreated,
|
|
resourcesProcessed: result.resourcesProcessed,
|
|
skippedExisting: result.skippedExisting,
|
|
});
|
|
} catch (error) {
|
|
logger.error({ error, route: "/api/cron/public-holidays", year }, "Public holiday import cron failed");
|
|
return NextResponse.json(
|
|
{ ok: false, error: "Internal error" },
|
|
{ status: 500 },
|
|
);
|
|
}
|
|
}
|