Expand KOC LOOP MCP operations

app/api/resources-export/route.ts

@@ -5,6 +5,7 @@ import {
   buildRecoveryWorkbook,
   type RecoveryWorkbookRow,
 } from "../../../lib/recovery-workbook";
+import { consumeMcpExportToken } from "../../../lib/mcp-export-token";
 
 export const runtime = "edge";
 
@@ -47,21 +48,20 @@ function exactArrayBuffer(bytes: Uint8Array) {
   return copy.buffer;
 }
 
-export async function POST(request: Request) {
-  if (!(await isManagerRequest(request))) return managerForbidden();
+function normalizeAccountIds(value: unknown) {
+  if (!Array.isArray(value)) return [];
+  return [
+    ...new Set(
+      value
+        .filter((item): item is string => typeof item === "string")
+        .map((item) => item.trim())
+        .filter(Boolean),
+    ),
+  ].slice(0, 5000);
+}
+
+async function exportAccounts(accountIds: string[]) {
   try {
-    const body = (await request.json()) as { accountIds?: unknown };
-    if (!Array.isArray(body.accountIds)) {
-      return Response.json({ error: "缺少需要导出的账号" }, { status: 400 });
-    }
-    const accountIds = [
-      ...new Set(
-        body.accountIds
-          .filter((value): value is string => typeof value === "string")
-          .map((value) => value.trim())
-          .filter(Boolean),
-      ),
-    ].slice(0, 5000);
     if (accountIds.length === 0) {
       return Response.json({ error: "当前筛选结果为空" }, { status: 400 });
     }
@@ -187,3 +187,28 @@ export async function POST(request: Request) {
     );
   }
 }
+
+export async function POST(request: Request) {
+  if (!(await isManagerRequest(request))) return managerForbidden();
+  try {
+    const body = (await request.json()) as { accountIds?: unknown };
+    if (!Array.isArray(body.accountIds)) {
+      return Response.json({ error: "缺少需要导出的账号" }, { status: 400 });
+    }
+    return exportAccounts(normalizeAccountIds(body.accountIds));
+  } catch (error) {
+    return Response.json(
+      { error: error instanceof Error ? error.message : "导出失败" },
+      { status: 500 },
+    );
+  }
+}
+
+export async function GET(request: Request) {
+  const token = new URL(request.url).searchParams.get("token")?.trim() || "";
+  const payload = token
+    ? await consumeMcpExportToken(token, "resources")
+    : null;
+  if (!payload) return managerForbidden();
+  return exportAccounts(normalizeAccountIds(payload.accountIds));
+}