feat: harden analytics dashboard

app/api/rankings/route.ts

@@ -1,24 +1,37 @@
 import { NextRequest, NextResponse } from "next/server";
+import { jsonError, parsePositiveInt, parseTimestampRange } from "@/lib/api-params";
 import { getUserRanking, getModelRanking, getChannelRanking } from "@/lib/queries";
 
 export async function GET(req: NextRequest) {
-  const sp = req.nextUrl.searchParams;
-  const type = sp.get("type") || "user";
-  const startTs = sp.get("start") ? Number(sp.get("start")) : undefined;
-  const endTs = sp.get("end") ? Number(sp.get("end")) : undefined;
-  const limit = sp.get("limit") ? Number(sp.get("limit")) : 50;
+  try {
+    const sp = req.nextUrl.searchParams;
+    const type = sp.get("type") || "user";
+    const range = parseTimestampRange(sp);
+    if (!range.ok) return jsonError(range.field);
 
-  let data;
-  switch (type) {
-    case "model":
-      data = await getModelRanking(startTs, endTs, limit);
-      break;
-    case "channel":
-      data = await getChannelRanking(startTs, endTs, limit);
-      break;
-    default:
-      data = await getUserRanking(startTs, endTs, limit);
+    const limit = parsePositiveInt(sp.get("limit"), {
+      field: "limit",
+      defaultValue: 50,
+      min: 1,
+      max: 100,
+    });
+    if (!limit.ok) return jsonError(limit.field);
+
+    let data;
+    switch (type) {
+      case "model":
+        data = await getModelRanking(range.value.startTs, range.value.endTs, limit.value);
+        break;
+      case "channel":
+        data = await getChannelRanking(range.value.startTs, range.value.endTs, limit.value);
+        break;
+      default:
+        data = await getUserRanking(range.value.startTs, range.value.endTs, limit.value);
+    }
+
+    return NextResponse.json(data);
+  } catch (error) {
+    console.error("Failed to load rankings", error);
+    return jsonError(undefined, 500);
   }
-
-  return NextResponse.json(data);
 }