Files
Jyotisha/frontend/src/app/api/rectification/cases/[caseId]/route.ts
T
jesse-uxandClaude Code 8d0359fc62
Independent Staging Quality Gate / validate (push) Successful in 10m4s
Independent Staging Quality Gate / publish (push) Successful in 10m26s
fix(rectification): enforce trusted result identity and preserve receipt provenance
Unify minute and block cache identity, keep unverifiable historical results read-only across server tools and write entrypoints, and aggregate completed receipt sources chronologically through a compatible function migration.

Co-Authored-By: Claude Code <noreply@anthropic.com>
2026-09-20 18:03:38 +08:00

120 lines
4.1 KiB
TypeScript

import { NextResponse } from "next/server";
import { z } from "zod";
import { jsonForSupabaseSetupFailure } from "@/lib/api/service-unavailable";
import { warnRectificationCaseGet } from "@/lib/rectification-case-get-log";
import { createAdminSupabaseClient } from "@/lib/supabase/admin";
import { withRectificationRequestCache } from "@/lib/rectification-agentic/v9/request-cache";
import { createServerSupabaseClient } from "@/lib/supabase/server";
import {
loadV9CaseDossier,
loadV9CaseSkillIdentityStatus,
loadV9TurnReceipt,
RectificationToolServiceError,
listV10ConversationFocuses,
safeToolErrorCode,
} from "@/lib/rectification-agentic/v9/tool-service";
import { dossierResponseWithIdentity } from "@/lib/rectification-agentic/v9/case-dossier-response";
export const runtime = "nodejs";
type RouteContext = { params: Promise<{ caseId: string }> };
/**
* GET /api/rectification/cases/[caseId]?sessionId=...
*
* Sanitized, durable refresh payload: case projection + persisted turns +
* evidence ledger + latest candidate snapshot + per-turn execution receipts.
* The browser restores real history from here; it never reconstructs history
* from candidate text or local sentinels.
*/
function failedCaseGet(
caseId: string,
status: number,
body: Record<string, unknown>,
reason: string,
) {
warnRectificationCaseGet({
caseId,
status,
code: typeof body.code === "string" ? body.code : `http_${status}`,
reason,
});
return NextResponse.json(body, { status });
}
export async function GET(request: Request, context: RouteContext) {
const { caseId } = await context.params;
const caseIdSafe = z.string().uuid().safeParse(caseId).success ? caseId : "";
let supabase;
let accounting;
try {
supabase = await createServerSupabaseClient();
accounting = withRectificationRequestCache(createAdminSupabaseClient());
} catch (error) {
const response = jsonForSupabaseSetupFailure(error, "GET /api/rectification/cases/[caseId]");
warnRectificationCaseGet({
caseId: caseIdSafe,
status: response.status,
code: "service_unavailable",
reason: safeToolErrorCode(error),
});
return response;
}
const {
data: { user },
error: authError,
} = await supabase.auth.getUser();
if (authError || !user) {
return failedCaseGet(caseIdSafe, 401, { error: "请先登录" }, authError ? safeToolErrorCode(authError) : "unauthenticated");
}
if (!caseIdSafe) {
return failedCaseGet(caseId, 400, { error: "请求内容不正确", code: "invalid_case_id" }, "invalid_case_id");
}
const searchParams = new URL(request.url).searchParams;
const sessionId = searchParams.get("sessionId") ?? "";
const fullDetail = searchParams.get("detail") === "full";
try {
const dossier = await loadV9CaseDossier(accounting, user.id, caseId);
if (sessionId && dossier.case.sessionId !== sessionId) {
return failedCaseGet(
caseId,
409,
{ error: "校正记录与会话绑定不一致", code: "case_session_mismatch" },
"case_session_mismatch",
);
}
const skillIdentity = await loadV9CaseSkillIdentityStatus(accounting, user.id, caseId);
const receipts = await Promise.all(
dossier.turns.map(async (turn) => {
try {
return await loadV9TurnReceipt(accounting, user.id, caseId, turn.id);
} catch {
return null;
}
}),
);
const listed = await listV10ConversationFocuses(accounting, user.id, caseId);
return NextResponse.json(await dossierResponseWithIdentity(dossier, receipts, skillIdentity, { fullDetail, listed }));
} catch (error) {
if (error instanceof RectificationToolServiceError) {
const message = error.message;
if (message.includes("agentic_rectification_case_not_found")) {
return failedCaseGet(
caseId,
404,
{ error: "校正记录不存在或无权访问", code: "case_not_found" },
safeToolErrorCode(error),
);
}
}
return failedCaseGet(
caseId,
503,
{ error: "暂时无法读取校正记录", code: "rectification_service_failed" },
safeToolErrorCode(error),
);
}
}