From f243132dc0d3f76f4231f699e1b1ba0a8be0de2e Mon Sep 17 00:00:00 2001
From: Dave <david.els1@outlook.com>
Date: Fri, 28 Aug 2026 00:07:57 +0200
Subject: [PATCH] refactor(boss-dashboard): use shared assertBrowserSession +
 cap page

---
 .../v1/boss-dashboard/rep-activity/route.ts   | 40 +++++--------------
 1 file changed, 11 insertions(+), 29 deletions(-)

diff --git a/src/app/api/v1/boss-dashboard/rep-activity/route.ts b/src/app/api/v1/boss-dashboard/rep-activity/route.ts
index ed3f674..0559d22 100644
--- a/src/app/api/v1/boss-dashboard/rep-activity/route.ts
+++ b/src/app/api/v1/boss-dashboard/rep-activity/route.ts
@@ -1,7 +1,9 @@
 import { NextRequest, NextResponse } from "next/server";
+import { assertBrowserSession } from "@/lib/server/browser-session";
 import {
   getBossRepActivity,
   type BossWindow,
+  type RepActivityKind,
 } from "@/lib/server/boss-dashboard-service";
 
 /**
@@ -16,32 +18,7 @@ export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
 
 const VALID_WINDOWS: BossWindow[] = ["today", "week", "month"];
-const VALID_KINDS = ["quotes", "orders"] as const;
-type ActivityKind = (typeof VALID_KINDS)[number];
-
-async function assertBrowserSession(req: NextRequest) {
-  const auth = req.headers.get("authorization");
-  if (!auth) {
-    throw Object.assign(new Error("Not authenticated."), { status: 401 });
-  }
-  const pbUrl =
-    process.env.NEXT_PUBLIC_POCKETBASE_URL || "http://127.0.0.1:8090";
-  const token = auth.startsWith("Bearer ") ? auth.slice(7) : auth;
-  const res = await fetch(
-    `${pbUrl.replace(/\/$/, "")}/api/collections/users/auth-refresh`,
-    {
-      method: "POST",
-      headers: { Authorization: token },
-      signal: AbortSignal.timeout(5000),
-    },
-  );
-  if (!res.ok) {
-    throw Object.assign(new Error("Invalid or expired session."), {
-      status: 401,
-    });
-  }
-  return res.json();
-}
+const VALID_KINDS: readonly RepActivityKind[] = ["quotes", "orders"];
 
 export async function GET(req: NextRequest) {
   try {
@@ -62,20 +39,25 @@ export async function GET(req: NextRequest) {
     }
 
     const kind = url.searchParams.get("kind") ?? "quotes";
-    if (!VALID_KINDS.includes(kind as ActivityKind)) {
+    if (!VALID_KINDS.includes(kind as RepActivityKind)) {
       return NextResponse.json(
         { error: `Invalid kind: ${kind}` },
         { status: 400 },
       );
     }
 
+    const MAX_PAGE = 1000;
     const pageParam = url.searchParams.get("page");
-    const page = pageParam ? Math.max(1, parseInt(pageParam, 10) || 1) : 1;
+    const parsed = pageParam ? parseInt(pageParam, 10) : NaN;
+    const page = Math.min(
+      MAX_PAGE,
+      Math.max(1, Number.isFinite(parsed) ? parsed : 1),
+    );
 
     const data = await getBossRepActivity({
       rep,
       window: window as BossWindow,
-      kind: kind as ActivityKind,
+      kind: kind as RepActivityKind,
       page,
     });
     return NextResponse.json(data);