`app/api/membership/marketplace/[id]/purchase/route.ts`

121 lines
import { NextRequest, NextResponse } from 'next/server';
import { marketplaceDb } from '@/lib/membershipDatabase';
import type { ApiResponse } from '@/src/types/membership';
import { checkRateLimit, getRateLimitConfig, getClientIdentifier } from '@/lib/rateLimit';
import { logAudit } from '@/lib/auth';
import { sanitizeString, validateUserId, validateEmail } from '@/lib/inputValidation';
import { analyzeRequest } from '@/lib/securityMonitoring';

export async function POST(
  request: NextRequest,
  { params }: { params: Promise<{ id: string }> }
) {
  try {
    const { id } = await params;

    // Rate limiting
    const identifier = getClientIdentifier(request);
    const rateLimit = checkRateLimit(identifier, getRateLimitConfig('/api/membership/marketplace'));

    if (!rateLimit.success) {
      return NextResponse.json({
        success: false,
        error: 'Rate limit exceeded. Please try again later.'
      } as ApiResponse<null>, { status: 429 });
    }

    // Threat detection
    const body = await request.json();
    const analysis = analyzeRequest({
      body,
      params: { id },
      headers: Object.fromEntries(request.headers),
      ip: identifier
    });

    if (!analysis.safe) {
      return NextResponse.json({
        success: false,
        error: 'Security threat detected'
      } as ApiResponse<null>, { status: 403 });
    }

    const { buyerId, buyerEmail, buyerName } = body;

    if (!buyerId || !buyerEmail || !buyerName) {
      return NextResponse.json({
        success: false,
        error: 'Missing required fields: buyerId, buyerEmail, buyerName'
      } as ApiResponse<null>, { status: 400 });
    }

    // Validate and sanitize
    const sanitizedListingId = sanitizeString(id, 100);
    const sanitizedBuyerId = sanitizeString(buyerId, 100);
    const sanitizedBuyerEmail = sanitizeString(buyerEmail, 200);
    const sanitizedBuyerName = sanitizeString(buyerName, 200);

    if (!validateUserId(sanitizedBuyerId)) {
      return NextResponse.json({
        success: false,
        error: 'Invalid buyer ID format'
      } as ApiResponse<null>, { status: 400 });
    }

    if (!validateEmail(sanitizedBuyerEmail)) {
      return NextResponse.json({
        success: false,
        error: 'Invalid email format'
      } as ApiResponse<null>, { status: 400 });
    }

    const result = marketplaceDb.completeSale(
      sanitizedListingId,
      sanitizedBuyerId,
      sanitizedBuyerEmail,
      sanitizedBuyerName
    );

    if (!result) {
      logAudit({
        action: 'MARKETPLACE_PURCHASE_FAILED',
        resource: `marketplace/${sanitizedListingId}`,
        ipAddress: identifier,
        userAgent: request.headers.get('user-agent') || 'unknown',
        success: false,
        metadata: { buyerId: sanitizedBuyerId }
      });

      return NextResponse.json({
        success: false,
        error: 'Failed to complete purchase. Listing may not exist or is no longer active.'
      } as ApiResponse<null>, { status: 400 });
    }

    logAudit({
      action: 'MARKETPLACE_PURCHASE',
      resource: `marketplace/${sanitizedListingId}`,
      ipAddress: identifier,
      userAgent: request.headers.get('user-agent') || 'unknown',
      success: true,
      metadata: {
        listingId: sanitizedListingId,
        buyerId: sanitizedBuyerId,
        buyerEmail: sanitizedBuyerEmail,
        price: result?.price || 0
      }
    });

    return NextResponse.json({
      success: true,
      data: result,
      message: 'Purchase completed successfully'
    });
  } catch (error) {
    return NextResponse.json({
      success: false,
      error: 'Failed to complete purchase'
    } as ApiResponse<null>, { status: 500 });
  }
}