@morphika/andami 0.2.8 → 0.2.10

package/app/api/admin/backups/status/route.ts

@@ -0,0 +1,35 @@
+import { NextResponse } from "next/server";
+import { isAdminAuthenticated } from "../../../../../lib/auth";
+import { jsonError } from "../../../../../lib/security";
+import { getBackupStatus } from "../../../../../lib/backup/export";
+import { logger } from "../../../../../lib/logger";
+
+/**
+ * GET /api/admin/backups/status — Backup readiness check.
+ *
+ * Returns:
+ *   - R2 connection status
+ *   - Asset count and total size
+ *   - Sanity document counts by type
+ *
+ * Used by the admin Backups page to show what will be included
+ * in the backup before the user clicks "Create Backup".
+ *
+ * Auth required. No CSRF (GET request).
+ */
+export async function GET() {
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  try {
+    const status = await getBackupStatus();
+    return NextResponse.json(status);
+  } catch (err) {
+    logger.error("[Admin:Backup]", "Status check failed", err);
+    return jsonError(
+      err instanceof Error ? err.message : "Status check failed",
+      500
+    );
+  }
+}

package/app/api/custom-sections/[id]/route.ts

@@ -1,15 +1,20 @@
 import { NextRequest, NextResponse } from "next/server";
-import { client } from "../../../../lib/sanity/client";
+import { adminClient } from "../../../../lib/sanity/client";
 import { customSectionByIdQuery } from "../../../../lib/sanity/queries";
 import { logger } from "../../../../lib/logger";
 
 type RouteContext = { params: Promise<{ id: string }> };
 
 /**
- * GET /api/custom-sections/[id] — Public: section data only (cached 1h CDN)
+ * GET /api/custom-sections/[id] — Public: section data only
  *
  * Returns only the `section` field (PageSectionV2 data) for rendering
  * custom section instances on the public site.
+ *
+ * Uses adminClient (useCdn: false) so data is always fresh after
+ * revalidatePath() is called from the admin PATCH endpoint.
+ * Cache is controlled via ISR revalidation on-demand, not via
+ * Cache-Control headers — this avoids stale CDN responses after edits.
  */
 export async function GET(_request: NextRequest, context: RouteContext) {
   try {
@@ -19,7 +24,7 @@ export async function GET(_request: NextRequest, context: RouteContext) {
       return NextResponse.json({ error: "Missing section ID" }, { status: 400 });
     }
 
-    const result = await client.fetch(customSectionByIdQuery, { id });
+    const result = await adminClient.fetch(customSectionByIdQuery, { id });
     if (!result?.section) {
       return NextResponse.json({ error: "Custom section not found" }, { status: 404 });
     }
@@ -28,8 +33,7 @@ export async function GET(_request: NextRequest, context: RouteContext) {
       { section: result.section },
       {
         headers: {
-          "Cache-Control": "public, s-maxage=3600, stale-while-revalidate=1800",
-          "CDN-Cache-Control": "public, s-maxage=3600",
+          "Cache-Control": "public, s-maxage=60, stale-while-revalidate=30",
         },
       }
     );