feat: harden analytics dashboard

app/api/logs/route.ts

@@ -1,19 +1,46 @@
 import { NextRequest, NextResponse } from "next/server";
+import { jsonError, parseOptionalInt, parsePositiveInt, parseTimestampRange } from "@/lib/api-params";
 import { getLogs } from "@/lib/queries";
 
 export async function GET(req: NextRequest) {
-  const sp = req.nextUrl.searchParams;
+  try {
+    const sp = req.nextUrl.searchParams;
+    const range = parseTimestampRange(sp);
+    if (!range.ok) return jsonError(range.field);
 
-  const data = await getLogs({
-    page: sp.get("page") ? Number(sp.get("page")) : 1,
-    pageSize: sp.get("page_size") ? Number(sp.get("page_size")) : 100,
-    startTs: sp.get("start") ? Number(sp.get("start")) : undefined,
-    endTs: sp.get("end") ? Number(sp.get("end")) : undefined,
-    username: sp.get("username") || undefined,
-    model: sp.get("model") || undefined,
-    channelId: sp.get("channel_id") ? Number(sp.get("channel_id")) : undefined,
-    tokenName: sp.get("token_name") || undefined,
-  });
+    const page = parsePositiveInt(sp.get("page"), {
+      field: "page",
+      defaultValue: 1,
+      min: 1,
+    });
+    if (!page.ok) return jsonError(page.field);
 
-  return NextResponse.json(data);
+    const pageSize = parsePositiveInt(sp.get("page_size"), {
+      field: "page_size",
+      defaultValue: 100,
+      min: 1,
+      max: 200,
+    });
+    if (!pageSize.ok) return jsonError(pageSize.field);
+
+    const channelId = parseOptionalInt(sp.get("channel_id"), "channel_id");
+    if (!channelId.ok) return jsonError(channelId.field);
+    if (channelId.value === 0) return jsonError("channel_id");
+
+    const data = await getLogs({
+      page: page.value,
+      pageSize: pageSize.value,
+      startTs: range.value.startTs,
+      endTs: range.value.endTs,
+      username: sp.get("username") || undefined,
+      model: sp.get("model") || undefined,
+      channelId: channelId.value,
+      tokenName: sp.get("token_name") || undefined,
+    });
+
+    return NextResponse.json(data);
+  } catch (error) {
+    console.error("Failed to load logs", error);
+    return jsonError(undefined, 500);
+  }
 }