← back to PoppyPetitions

app/api/health/route.ts

21 lines

import { NextResponse } from 'next/server';

/**
 * 2026-05-05 (P1-D): Trimmed unauthenticated health response.
 *
 * The previous version returned `process.uptime()` (recon: how long since
 * last restart, useful for fingerprinting deploy cadence) and a `service`
 * field that named internal infra. For a closed admin tool reachable on
 * its port, even minor recon should be denied to unauth callers.
 *
 * Tradeoff: kept the endpoint UNAUTHENTICATED so external uptime checkers
 * (pm2's own check, launchd watchdog, future load balancer) can poll it
 * without credentials. The response is now an opaque "ok" — enough to
 * confirm the process is up, nothing more.
 *
 * Authenticated callers can use /api/auth/session for a richer signal.
 */
export async function GET() {
  return NextResponse.json({ status: 'ok' });
}