Function postAdImpression

web/src/app/api/v1/ads/impression/_post.ts:79–249

(params: {
  req: NextRequest
  getUserInfoFromApiKey: GetUserInfoFromApiKeyFn
  logger: Logger
  loggerWithContext: LoggerWithContextFn
  trackEvent: TrackEventFn
  fetch: typeof globalThis.fetch
})

})

export async function postAdImpression(params: {
  req: NextRequest
  getUserInfoFromApiKey: GetUserInfoFromApiKeyFn
  logger: Logger
  loggerWithContext: LoggerWithContextFn
  trackEvent: TrackEventFn
  fetch: typeof globalThis.fetch
}) {
  const { req, getUserInfoFromApiKey, loggerWithContext, trackEvent, fetch } =
    params
  const baseLogger = params.logger

  // Parse and validate request body
  let impUrl: string
  try {
    const json = await req.json()
    const parsed = bodySchema.safeParse(json)
    if (!parsed.success) {
      return NextResponse.json(
        { error: 'Invalid request body', details: parsed.error.format() },
        { status: 400 },
      )
    }
    impUrl = parsed.data.impUrl
  } catch {
    return NextResponse.json(
      { error: 'Invalid JSON in request body' },
      { status: 400 },
    )
  }

  const authed = await requireUserFromApiKey({
    req,
    getUserInfoFromApiKey,
    logger: baseLogger,
    loggerWithContext,
    trackEvent,
    authErrorEvent: AnalyticsEvent.USAGE_API_AUTH_ERROR,
  })
  if (!authed.ok) return authed.response

  const { userId, logger } = authed.data

  // Look up the ad from our database using the impUrl
  // This ensures we use server-side trusted data, not client-provided data
  const adRecord = await db.query.adImpression.findFirst({
    where: eq(schema.adImpression.imp_url, impUrl),
  })

  if (!adRecord) {
    logger.warn(
      { userId, impUrl },
      '[ads] Ad impression not found in database - was it served through our API?',
    )
    return NextResponse.json(
      { success: false, error: 'Ad not found', creditsGranted: 0 },
      { status: 404 },
    )