Function luaApiCall

app/src/DataModel/Scripting/ScriptApiCall.cpp:618–691

* @brief Lua C closure for apiCall(method, params?) returning a result table. */

 * @brief Lua C closure for apiCall(method, params?) returning a result table.
 */
static int luaApiCall(lua_State* L)
{
  const int sourceId = static_cast<int>(lua_tointeger(L, lua_upvalueindex(1)));

  if (!lua_isstring(L, 1)) {
    pushLuaErr(L, QStringLiteral("apiCall: method must be a string"));
    return 1;
  }

  size_t mlen      = 0;
  const char* mstr = lua_tolstring(L, 1, &mlen);
  const QString method(QString::fromUtf8(mstr, static_cast<int>(mlen)));
  if (method.isEmpty()) {
    pushLuaErr(L, QStringLiteral("apiCall: method must not be empty"));
    return 1;
  }

  if (!API::CommandRegistry::instance().hasCommand(method)) {
    pushApiResult(L, dispatchApiCall(method, QJsonObject()));
    return 1;
  }

  if (!isAllowed(method)) {
    pushLuaErr(L,
               QStringLiteral("apiCall: method '%1' not in default allow-list "
                              "(enable apiCall.allowFullSurface in project to opt in)")
                 .arg(method),
               QStringLiteral("METHOD_NOT_ALLOWED"));
    return 1;
  }

  QJsonObject params;
  if (lua_gettop(L) >= 2 && !lua_isnil(L, 2)) {
    if (!lua_istable(L, 2)) {
      pushLuaErr(L, QStringLiteral("apiCall: params must be a table"));
      return 1;
    }

    const QJsonValue v = luaTableToJson(L, 2, 0);
    if (v.isObject())
      params = v.toObject();
    else {
      pushLuaErr(L, QStringLiteral("apiCall: params must be an object-like table"));
      return 1;
    }

    if (approxJsonSize(params) > kMaxBodyBytes) {
      pushLuaErr(L, QStringLiteral("apiCall: params exceed %1 byte cap").arg(kMaxBodyBytes));
      return 1;
    }
  }

  if (!consumeRateToken(sourceId)) {
    pushLuaErr(L, QStringLiteral("apiCall: rate-limited or concurrency cap reached for source"));
    return 1;
  }

  try {