Function getFreebuffSession

web/src/app/api/v1/freebuff/session/_handlers.ts:273–319

(
  req: NextRequest,
  deps: FreebuffSessionDeps,
)

 *  caller's instance id (via X-Freebuff-Instance-Id) is used to detect
 *  takeover by another CLI on the same account. */
export async function getFreebuffSession(
  req: NextRequest,
  deps: FreebuffSessionDeps,
): Promise<NextResponse> {
  const auth = await resolveUser(req, deps)
  if ('error' in auth) return auth.error

  try {
    const countryAccess = await getCountryAccess(auth.userId, req, deps)
    logCountryAccess('GET', auth.userId, countryAccess, deps)
    if (shouldHardBlockFreeModeAccess(countryAccess)) {
      await endSessionForHardBlock(auth, deps)
      return hardBlockedResponse(countryAccess)
    }
    const accessTier = getFreeModeAccessTier(countryAccess)

    const claimedInstanceId =
      req.headers.get(FREEBUFF_INSTANCE_HEADER) ?? undefined
    const state = await getSessionState({
      userId: auth.userId,
      accessTier,
      userEmail: auth.userEmail,
      userBanned: auth.userBanned,
      claimedInstanceId,
      deps: deps.sessionDeps,
    })
    if (state.status === 'none') {
      return NextResponse.json(
        {
          status: 'none',
          accessTier: state.accessTier,
          message: 'Call POST to join the waiting room.',
          queueDepthByModel: state.queueDepthByModel,
          rateLimitsByModel: state.rateLimitsByModel,
          ...toLimitedModeReason(countryAccess),
        },
        { status: 200 },
      )
    }
    // banned is terminal; 403 for the same reason as country_blocked — older
    // CLIs that don't know this status treat it as a generic error.
    const status = state.status === 'banned' ? 403 : 200
    return NextResponse.json(state, { status })
  } catch (error) {
    return serverError(deps, 'GET', auth.userId, error)
  }
}

/** DELETE /api/v1/freebuff/session — end session / leave queue immediately. */
export async function deleteFreebuffSession(