Scrum4Me/app/api/debug/realtime-stream/route.ts
Madhura68 0f40bc1c70 fix(privacy): NODE_ENV-guard 4 debug-routes (before-launch privacy review)
Privacy/PII review-pass van Server Actions, API-routes, debug-paths en
Sentry config:

 Sentry sendDefaultPii: false in alle drie configs (server/edge/client)
 Geen wachtwoord/email/token in console-logs
 Pair-id-logs zijn metadata-only (5-min TTL, geen secret)

⚠️ Vier debug-routes hadden geen auth-guard:
- /api/debug/realtime-stream — rauwe pg_notify-stream zonder filtering
- /api/debug/emit-test-notify — anonieme test-emit op het kanaal
- /debug-env — lekt env-var-metadata (hostnames, lengtes, pooled-flag)
- /debug-realtime — UI op dezelfde rauwe pg_notify-stream

Allemaal gemarkeerd als TIJDELIJK met VERWIJDEREN-comments uit M8.
Voor v1 launch: NODE_ENV-guard die in productie 404 retourneert. Lokaal
dev blijft alles werken voor debugging.

Toekomstige cleanup: kunnen worden verwijderd zodra M8-realtime stabiel
draait in productie en niemand ze meer nodig heeft.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-04 14:16:49 +02:00

119 lines
3.5 KiB
TypeScript

// TIJDELIJKE debug-endpoint voor M8-acceptance.
// Geen auth, geen filtering — alle pg_notify-events op `scrum4me_changes`
// stromen rauw door naar de browser. Bedoeld om te isoleren of de
// SSE + LISTEN-pipe op Vercel werkt, los van iron-session, productfilter
// of solo-store.
//
// VERWIJDEREN VOOR M8 OUT-OF-DRAFT.
import { NextRequest } from 'next/server'
import { Client } from 'pg'
export const runtime = 'nodejs'
export const dynamic = 'force-dynamic'
export const maxDuration = 300
const CHANNEL = 'scrum4me_changes'
export async function GET(request: NextRequest) {
// Productie-guard: deze debug-stream lekt rauw alle pg_notify-events.
if (process.env.NODE_ENV === 'production') {
return new Response('Not found', { status: 404 })
}
const directUrl = process.env.DIRECT_URL ?? process.env.DATABASE_URL
if (!directUrl) {
return Response.json({ error: 'DIRECT_URL/DATABASE_URL niet gezet' }, { status: 500 })
}
const isPooled = directUrl.includes('pooler.')
const hostHint = directUrl.match(/@([^/]+)/)?.[1] ?? 'unknown-host'
console.log(`[debug-realtime] connecting (${isPooled ? 'POOLED' : 'direct'}) host=${hostHint}`)
const encoder = new TextEncoder()
const pgClient = new Client({ connectionString: directUrl })
let closed = false
let heartbeatTimer: ReturnType<typeof setInterval> | null = null
const stream = new ReadableStream({
async start(controller) {
const enqueue = (chunk: string) => {
if (closed) return
try {
controller.enqueue(encoder.encode(chunk))
} catch {
// already closed
}
}
const cleanup = async (reason: string) => {
if (closed) return
closed = true
if (heartbeatTimer) clearInterval(heartbeatTimer)
try {
await pgClient.end()
} catch {
// ignore
}
try {
controller.close()
} catch {
// already closed
}
console.log(`[debug-realtime] closed: ${reason}`)
}
try {
await pgClient.connect()
await pgClient.query(`LISTEN ${CHANNEL}`)
console.log('[debug-realtime] LISTEN ready')
} catch (err) {
console.error('[debug-realtime] pg connect/listen failed:', err)
enqueue(`event: error\ndata: ${JSON.stringify({ message: String(err) })}\n\n`)
await cleanup('pg connect failed')
return
}
pgClient.on('notification', (msg) => {
console.log(`[debug-realtime] RAW notification length=${msg.payload?.length ?? 0}`)
if (!msg.payload) return
enqueue(`data: ${msg.payload}\n\n`)
})
pgClient.on('error', async (err) => {
console.error('[debug-realtime] pg client error:', err)
await cleanup('pg error')
})
pgClient.on('end', () => {
console.log('[debug-realtime] pg client end')
})
enqueue(
`event: ready\ndata: ${JSON.stringify({
host: hostHint,
pooled: isPooled,
channel: CHANNEL,
time: new Date().toISOString(),
})}\n\n`,
)
heartbeatTimer = setInterval(() => {
enqueue(`: heartbeat ${new Date().toISOString()}\n\n`)
}, 25_000)
request.signal.addEventListener('abort', () => {
cleanup('client aborted')
})
},
})
return new Response(stream, {
headers: {
'Content-Type': 'text/event-stream; charset=utf-8',
'Cache-Control': 'no-cache, no-transform',
Connection: 'keep-alive',
'X-Accel-Buffering': 'no',
},
})
}