Privacy/PII review-pass van Server Actions, API-routes, debug-paths en Sentry config: ✅ Sentry sendDefaultPii: false in alle drie configs (server/edge/client) ✅ Geen wachtwoord/email/token in console-logs ✅ Pair-id-logs zijn metadata-only (5-min TTL, geen secret) ⚠️ Vier debug-routes hadden geen auth-guard: - /api/debug/realtime-stream — rauwe pg_notify-stream zonder filtering - /api/debug/emit-test-notify — anonieme test-emit op het kanaal - /debug-env — lekt env-var-metadata (hostnames, lengtes, pooled-flag) - /debug-realtime — UI op dezelfde rauwe pg_notify-stream Allemaal gemarkeerd als TIJDELIJK met VERWIJDEREN-comments uit M8. Voor v1 launch: NODE_ENV-guard die in productie 404 retourneert. Lokaal dev blijft alles werken voor debugging. Toekomstige cleanup: kunnen worden verwijderd zodra M8-realtime stabiel draait in productie en niemand ze meer nodig heeft. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
119 lines
3.5 KiB
TypeScript
119 lines
3.5 KiB
TypeScript
// TIJDELIJKE debug-endpoint voor M8-acceptance.
|
|
// Geen auth, geen filtering — alle pg_notify-events op `scrum4me_changes`
|
|
// stromen rauw door naar de browser. Bedoeld om te isoleren of de
|
|
// SSE + LISTEN-pipe op Vercel werkt, los van iron-session, productfilter
|
|
// of solo-store.
|
|
//
|
|
// VERWIJDEREN VOOR M8 OUT-OF-DRAFT.
|
|
|
|
import { NextRequest } from 'next/server'
|
|
import { Client } from 'pg'
|
|
|
|
export const runtime = 'nodejs'
|
|
export const dynamic = 'force-dynamic'
|
|
export const maxDuration = 300
|
|
|
|
const CHANNEL = 'scrum4me_changes'
|
|
|
|
export async function GET(request: NextRequest) {
|
|
// Productie-guard: deze debug-stream lekt rauw alle pg_notify-events.
|
|
if (process.env.NODE_ENV === 'production') {
|
|
return new Response('Not found', { status: 404 })
|
|
}
|
|
|
|
const directUrl = process.env.DIRECT_URL ?? process.env.DATABASE_URL
|
|
if (!directUrl) {
|
|
return Response.json({ error: 'DIRECT_URL/DATABASE_URL niet gezet' }, { status: 500 })
|
|
}
|
|
|
|
const isPooled = directUrl.includes('pooler.')
|
|
const hostHint = directUrl.match(/@([^/]+)/)?.[1] ?? 'unknown-host'
|
|
console.log(`[debug-realtime] connecting (${isPooled ? 'POOLED' : 'direct'}) host=${hostHint}`)
|
|
|
|
const encoder = new TextEncoder()
|
|
const pgClient = new Client({ connectionString: directUrl })
|
|
let closed = false
|
|
let heartbeatTimer: ReturnType<typeof setInterval> | null = null
|
|
|
|
const stream = new ReadableStream({
|
|
async start(controller) {
|
|
const enqueue = (chunk: string) => {
|
|
if (closed) return
|
|
try {
|
|
controller.enqueue(encoder.encode(chunk))
|
|
} catch {
|
|
// already closed
|
|
}
|
|
}
|
|
|
|
const cleanup = async (reason: string) => {
|
|
if (closed) return
|
|
closed = true
|
|
if (heartbeatTimer) clearInterval(heartbeatTimer)
|
|
try {
|
|
await pgClient.end()
|
|
} catch {
|
|
// ignore
|
|
}
|
|
try {
|
|
controller.close()
|
|
} catch {
|
|
// already closed
|
|
}
|
|
console.log(`[debug-realtime] closed: ${reason}`)
|
|
}
|
|
|
|
try {
|
|
await pgClient.connect()
|
|
await pgClient.query(`LISTEN ${CHANNEL}`)
|
|
console.log('[debug-realtime] LISTEN ready')
|
|
} catch (err) {
|
|
console.error('[debug-realtime] pg connect/listen failed:', err)
|
|
enqueue(`event: error\ndata: ${JSON.stringify({ message: String(err) })}\n\n`)
|
|
await cleanup('pg connect failed')
|
|
return
|
|
}
|
|
|
|
pgClient.on('notification', (msg) => {
|
|
console.log(`[debug-realtime] RAW notification length=${msg.payload?.length ?? 0}`)
|
|
if (!msg.payload) return
|
|
enqueue(`data: ${msg.payload}\n\n`)
|
|
})
|
|
|
|
pgClient.on('error', async (err) => {
|
|
console.error('[debug-realtime] pg client error:', err)
|
|
await cleanup('pg error')
|
|
})
|
|
|
|
pgClient.on('end', () => {
|
|
console.log('[debug-realtime] pg client end')
|
|
})
|
|
|
|
enqueue(
|
|
`event: ready\ndata: ${JSON.stringify({
|
|
host: hostHint,
|
|
pooled: isPooled,
|
|
channel: CHANNEL,
|
|
time: new Date().toISOString(),
|
|
})}\n\n`,
|
|
)
|
|
|
|
heartbeatTimer = setInterval(() => {
|
|
enqueue(`: heartbeat ${new Date().toISOString()}\n\n`)
|
|
}, 25_000)
|
|
|
|
request.signal.addEventListener('abort', () => {
|
|
cleanup('client aborted')
|
|
})
|
|
},
|
|
})
|
|
|
|
return new Response(stream, {
|
|
headers: {
|
|
'Content-Type': 'text/event-stream; charset=utf-8',
|
|
'Cache-Control': 'no-cache, no-transform',
|
|
Connection: 'keep-alive',
|
|
'X-Accel-Buffering': 'no',
|
|
},
|
|
})
|
|
}
|