app/api/chartmetric/[...path]/route.ts (1)

16-34: Consider adding an OPTIONS handler for CORS preflight.

Browser-based clients making cross-origin requests will send a preflight OPTIONS request. While the responses include CORS headers via getCorsHeaders(), there's no explicit OPTIONS handler to respond to preflight requests.

If this API is intended for server-to-server use only, this is fine. But if browser clients will call it directly, an OPTIONS handler is needed.

♻️ Add OPTIONS handler if browser clients are expected

import { getCorsHeaders } from "@/lib/networking/getCorsHeaders";
import { NextResponse } from "next/server";

/**
 * OPTIONS /api/chartmetric/[...path]
 *
 * Handles CORS preflight requests.
 */
export async function OPTIONS() {
  return new NextResponse(null, { status: 204, headers: getCorsHeaders() });
}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@app/api/chartmetric/`[...path]/route.ts around lines 16 - 34, Add an OPTIONS
handler to this route to respond to CORS preflight requests: export an async
function OPTIONS() that returns a 204 NextResponse with headers from
getCorsHeaders(), and import getCorsHeaders and NextResponse at the top; place
it alongside the existing GET/POST handlers (which call proxyChartmetricRequest)
so browser clients receive proper CORS preflight responses.

lib/chartmetric/proxyChartmetricRequest.ts (2)

92-97: Handle non-JSON upstream responses gracefully.

If Chartmetric returns a non-JSON response (e.g., an HTML error page during outages), chartmetricResponse.json() will throw. While the catch block handles this, the error message will be generic. Consider checking Content-Type or wrapping the JSON parse more explicitly.

♻️ Suggested improvement

   try {
     const chartmetricResponse = await fetch(chartmetricUrl, {
       method: request.method,
       headers: {
         Authorization: `Bearer ${accessToken}`,
         "Content-Type": "application/json",
       },
       ...(body ? { body } : {}),
     });

-    const data = await chartmetricResponse.json();
+    const contentType = chartmetricResponse.headers.get("content-type") ?? "";
+    if (!contentType.includes("application/json")) {
+      const text = await chartmetricResponse.text();
+      return NextResponse.json(
+        { status: "error", error: `Chartmetric returned non-JSON response: ${text.slice(0, 200)}` },
+        { status: 502, headers: getCorsHeaders() },
+      );
+    }
+    const data = await chartmetricResponse.json();

     return NextResponse.json(data, {
       status: chartmetricResponse.status,
       headers: getCorsHeaders(),
     });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@lib/chartmetric/proxyChartmetricRequest.ts` around lines 92 - 97, The code
currently calls chartmetricResponse.json() which will throw on non-JSON
responses; update proxyChartmetricRequest to first inspect
chartmetricResponse.headers.get('content-type') (or attempt a safe JSON parse)
and only call .json() when content-type includes 'application/json'; otherwise
call chartmetricResponse.text() and return that body (or a structured fallback
error) via NextResponse.json/NextResponse.text with the original
chartmetricResponse.status and getCorsHeaders(); ensure chartmetricResponse and
getCorsHeaders are the referenced symbols used and keep existing status/headers
behavior for all branches.

---

38-46: String-based error detection is fragile coupling.

The check message.toLowerCase().includes("insufficient credits") couples this code to the exact wording of deductCredits's error message. If that message changes, the 402 response breaks silently and becomes a 500.

Consider having deductCredits throw a typed error (or return a discriminated result) so consumers can reliably detect insufficient credits without string parsing.

♻️ Example: Use a custom error class

In lib/credits/deductCredits.ts:

export class InsufficientCreditsError extends Error {
  constructor(required: number, available: number) {
    super(`Insufficient credits. Required: ${required}, Available: ${available}`);
    this.name = "InsufficientCreditsError";
  }
}

Then in proxyChartmetricRequest.ts:

-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-
-    if (message.toLowerCase().includes("insufficient credits")) {
+  } catch (err) {
+    if (err instanceof InsufficientCreditsError) {
       return NextResponse.json(
         { status: "error", error: "Insufficient credits for Chartmetric API call" },
         { status: 402, headers: getCorsHeaders() },
       );
     }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@lib/chartmetric/proxyChartmetricRequest.ts` around lines 38 - 46, The catch
block in proxyChartmetricRequest.ts currently detects insufficient credits by
string-parsing the error message which is fragile; update deductCredits to throw
a dedicated error type (e.g., export class InsufficientCreditsError extends
Error or return a discriminated result) and then change the catch in
proxyChartmetricRequest (and any other consumers) to detect that case via
instanceof InsufficientCreditsError (or by checking the discriminant) and return
the 402 NextResponse.json with getCorsHeaders(); otherwise rethrow or handle
other errors normally.

app/api/chartmetric/[...path]/route.ts (1)

8-8: ⚠️ Potential issue | 🟡 Minor

JSDoc credit cost is inconsistent with actual deduction.

Line 8 and Line 25 say 1 credit, but the proxy implementation deducts 5 credits. Please align both handler docs with runtime behavior.

📝 Suggested doc fix

- * Deducts 1 credit per call.
+ * Deducts 5 credits per call.

Also applies to: 25-25

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@app/api/chartmetric/`[...path]/route.ts at line 8, The JSDoc in
app/api/chartmetric/[...path]/route.ts incorrectly states "Deducts 1 credit per
call" while the proxy implementation deducts 5 credits; update the handler's
JSDoc comments (the top-of-file comment and the inline comment at line 25) to
state "Deducts 5 credits per call" so the documentation matches the runtime
behavior of the route handler in route.ts.

app/api/chartmetric/[...path]/route.ts (1)

16-19: Extract shared GET/POST proxy flow into a single helper.

Line 16-19 and Line 33-36 duplicate the same params-await + proxy call path. A shared internal handler keeps this route simpler and easier to evolve.

As per coding guidelines: "**/*.{ts,tsx}: Extract shared logic into reusable utilities following Don't Repeat Yourself (DRY) principle."

Also applies to: 33-36

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@app/api/chartmetric/`[...path]/route.ts around lines 16 - 19, Extract the
duplicated params-await + proxy call into a small internal helper (e.g.,
handleChartmetricProxy) and have both exported GET and POST call it;
specifically, move the logic that awaits context.params and calls
proxyChartmetricRequest(request, params) into a single function (referencing
GET, POST, context.params, and proxyChartmetricRequest) and replace the
duplicated bodies in GET and POST with a call to that helper to keep the route
DRY and easier to evolve.