koc-loop/app/api/creator-screenshot/route.ts

import {
  ensureSchema,
  getRawDb,
  getUploadBucket,
} from "../../../lib/mvp-db";
import { adminForbidden, isAdminRequest } from "../../../lib/admin-auth";
import { verifyCreatorScreenshotAccessToken } from "../../../lib/creator-screenshot-access";

export async function GET(request: Request) {
  const isAdmin = await isAdminRequest(request);
  try {
    await ensureSchema();
    const url = new URL(request.url);
    const distributionId = url.searchParams.get("distribution")?.trim();
    // kind=public-metrics 时返回 KOC 补交的公开数据截图（仅后台核对用）
    const imageKind = url.searchParams.get("kind") === "public-metrics"
      ? "public-metrics"
      : "creator";
    if (!distributionId) {
      return Response.json({ error: "缺少分发记录" }, { status: 400 });
    }
    const row = await getRawDb()
      .prepare(
        `SELECT screenshot_key, public_metrics_screenshot_key FROM distributions
         WHERE id = ?`,
      )
      .bind(distributionId)
      .first<{
        screenshot_key: string | null;
        public_metrics_screenshot_key: string | null;
      }>();
    const mcpToken = url.searchParams.get("mcp_token") || "";
    const key =
      imageKind === "public-metrics"
        ? row?.public_metrics_screenshot_key ?? null
        : row?.screenshot_key ?? null;
    if (imageKind === "public-metrics" && !isAdmin) {
      return adminForbidden();
    }
    if (
      !isAdmin &&
      (!row?.screenshot_key ||
        !verifyCreatorScreenshotAccessToken(
          distributionId,
          row.screenshot_key,
          mcpToken,
        ))
    ) {
      return adminForbidden();
    }
    if (
      !key ||
      !key.startsWith(
        imageKind === "public-metrics" ? "public-metrics/" : "creator-center/",
      )
    ) {
      return Response.json({ error: "截图不存在" }, { status: 404 });
    }
    const object = await getUploadBucket().get(key);
    if (!object) {
      return Response.json({ error: "截图不存在" }, { status: 404 });
    }
    const headers = new Headers({
      "Cache-Control": "private, no-store",
      "Content-Disposition": `inline; filename="${imageKind}-screenshot"`,
      "X-Content-Type-Options": "nosniff",
    });
    object.writeHttpMetadata(headers);
    if (!headers.get("Content-Type")) {
      headers.set("Content-Type", "image/jpeg");
    }
    return new Response(await object.arrayBuffer(), { headers });
  } catch (error) {
    return Response.json(
      { error: error instanceof Error ? error.message : "截图读取失败" },
      { status: 500 },
    );
  }
}