feat: harden analytics dashboard

app/api/rankings/route.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, mock, test } from "bun:test";
+import type { NextRequest } from "next/server";
+
+const getUserRankingMock = mock(async () => []);
+const getModelRankingMock = mock(async () => []);
+const getChannelRankingMock = mock(async () => []);
+const getLogsMock = mock(async () => ({ logs: [], total: 0, page: 1, page_size: 100 }));
+
+mock.module("@/lib/queries", () => ({
+  getUserRanking: getUserRankingMock,
+  getModelRanking: getModelRankingMock,
+  getChannelRanking: getChannelRankingMock,
+  getLogs: getLogsMock,
+}));
+
+const { GET } = await import("./route");
+
+function request(path: string) {
+  return { nextUrl: new URL(`http://localhost${path}`) } as NextRequest;
+}
+
+describe("/api/rankings", () => {
+  test("rejects invalid limit", async () => {
+    const res = await GET(request("/api/rankings?limit=abc"));
+
+    expect(res.status).toBe(400);
+    expect(await res.json()).toEqual({
+      error: "Invalid query parameter",
+      field: "limit",
+    });
+  });
+
+  test("clamps oversized limit before querying", async () => {
+    getUserRankingMock.mockClear();
+
+    const res = await GET(request("/api/rankings?limit=500"));
+
+    expect(res.status).toBe(200);
+    expect(getUserRankingMock.mock.calls[0]).toEqual([undefined, undefined, 100]);
+  });
+});

app/api/rankings/route.ts

@@ -1,24 +1,37 @@
 import { NextRequest, NextResponse } from "next/server";
+import { jsonError, parsePositiveInt, parseTimestampRange } from "@/lib/api-params";
 import { getUserRanking, getModelRanking, getChannelRanking } from "@/lib/queries";
 
 export async function GET(req: NextRequest) {
-  const sp = req.nextUrl.searchParams;
-  const type = sp.get("type") || "user";
-  const startTs = sp.get("start") ? Number(sp.get("start")) : undefined;
-  const endTs = sp.get("end") ? Number(sp.get("end")) : undefined;
-  const limit = sp.get("limit") ? Number(sp.get("limit")) : 50;
+  try {
+    const sp = req.nextUrl.searchParams;
+    const type = sp.get("type") || "user";
+    const range = parseTimestampRange(sp);
+    if (!range.ok) return jsonError(range.field);
 
-  let data;
-  switch (type) {
-    case "model":
-      data = await getModelRanking(startTs, endTs, limit);
-      break;
-    case "channel":
-      data = await getChannelRanking(startTs, endTs, limit);
-      break;
-    default:
-      data = await getUserRanking(startTs, endTs, limit);
+    const limit = parsePositiveInt(sp.get("limit"), {
+      field: "limit",
+      defaultValue: 50,
+      min: 1,
+      max: 100,
+    });
+    if (!limit.ok) return jsonError(limit.field);
+
+    let data;
+    switch (type) {
+      case "model":
+        data = await getModelRanking(range.value.startTs, range.value.endTs, limit.value);
+        break;
+      case "channel":
+        data = await getChannelRanking(range.value.startTs, range.value.endTs, limit.value);
+        break;
+      default:
+        data = await getUserRanking(range.value.startTs, range.value.endTs, limit.value);
+    }
+
+    return NextResponse.json(data);
+  } catch (error) {
+    console.error("Failed to load rankings", error);
+    return jsonError(undefined, 500);
   }
-
-  return NextResponse.json(data);
 }