feat: routes-b exchange-rate resilience, PAT flow, authz helper, and notification preferences

app/api/routes-b/_lib/authz.ts

@@ -0,0 +1,50 @@
+import { NextRequest } from 'next/server'
+import crypto from 'crypto'
+import { prisma } from '@/lib/db'
+import { verifyAuthToken } from '@/lib/auth'
+
+export class RoutesBForbiddenError extends Error {
+  code = 'FORBIDDEN'
+  status = 403
+}
+
+type AuthContext = { userId: string; role: string; scopes: string[] }
+
+export async function resolveRoutesBAuth(req: NextRequest): Promise<AuthContext | null> {
+  const authHeader = req.headers.get('authorization')
+  const token = authHeader?.startsWith('Bearer ') ? authHeader.slice(7).trim() : ''
+  if (!token) return null
+
+  const claims = await verifyAuthToken(token)
+  if (claims?.userId) {
+    const user = await prisma.user.findUnique({ where: { privyId: claims.userId }, select: { id: true, role: true } })
+    if (!user) return null
+    return { userId: user.id, role: user.role, scopes: ['routes-b:read'] }
+  }
+
+  const hashedKey = crypto.createHash('sha256').update(token).digest('hex')
+  const apiKey = await prisma.apiKey.findUnique({ where: { hashedKey }, select: { id: true, userId: true, isActive: true, name: true } })
+  if (!apiKey || !apiKey.isActive || !apiKey.name.startsWith('routes-b-pat:')) return null
+
+  const user = await prisma.user.findUnique({ where: { id: apiKey.userId }, select: { role: true } })
+  if (!user) return null
+
+  await prisma.apiKey.update({ where: { id: apiKey.id }, data: { lastUsedAt: new Date() } })
+  return { userId: apiKey.userId, role: user.role, scopes: ['routes-b:read'] }
+}
+
+export async function requireScope(req: NextRequest, scope: string): Promise<AuthContext> {
+  const auth = await resolveRoutesBAuth(req)
+  if (!auth || !auth.scopes.includes(scope)) throw new RoutesBForbiddenError('Missing required scope')
+  return auth
+}
+
+export async function requireRole(req: NextRequest, role: string): Promise<AuthContext> {
+  const auth = await resolveRoutesBAuth(req)
+  if (!auth || auth.role !== role) throw new RoutesBForbiddenError('Missing required role')
+  return auth
+}
+
+export function hasScope(scopes: string[], scope: string): boolean {
+  return scopes.includes(scope)
+}

app/api/routes-b/analytics/top-months/route.ts

@@ -0,0 +1,50 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { prisma } from '@/lib/db'
+import { verifyAuthToken } from '@/lib/auth'
+
+/**
+ * GET /api/routes-b/analytics/top-months
+ * Returns the three calendar months with the highest paid invoice totals for the authenticated user.
+ */
+export async function GET(request: NextRequest) {
+  try {
+    const authToken = request.headers.get('authorization')?.replace('Bearer ', '')
+    const claims = await verifyAuthToken(authToken || '')
+    if (!claims) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const user = await prisma.user.findUnique({ where: { privyId: claims.userId } })
+    if (!user) {
+      return NextResponse.json({ error: 'User not found' }, { status: 404 })
+    }
+
+    // Fetch all paid invoices for the user
+    const paid = await prisma.invoice.findMany({
+      where: { userId: user.id, status: 'paid' },
+      select: { amount: true, paidAt: true },
+    })
+
+    // Group by "YYYY-MM" in application code (Prisma does not support month-level groupBy portably)
+    const monthly: Record<string, number> = {}
+    for (const inv of paid) {
+      if (!inv.paidAt) continue
+      const key = inv.paidAt.toISOString().slice(0, 7) // "2025-01"
+      monthly[key] = (monthly[key] ?? 0) + Number(inv.amount)
+    }
+
+    // Sort by earned amount descending and take top 3
+    const topMonths = Object.entries(monthly)
+      .sort(([, a], [, b]) => b - a)
+      .slice(0, 3)
+      .map(([month, earned]) => ({ 
+        month, 
+        earned: Number(earned.toFixed(2)) 
+      }))
+
+    return NextResponse.json({ topMonths })
+  } catch (error) {
+    console.error('Top months analytics error:', error)
+    return NextResponse.json({ error: 'Failed to fetch analytics' }, { status: 500 })
+  }
+}

app/api/routes-b/analytics/withdrawals/route.ts

@@ -0,0 +1,55 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { prisma } from '@/lib/db'
+import { verifyAuthToken } from '@/lib/auth'
+import { logger } from '@/lib/logger'
+
+export async function GET(request: NextRequest) {
+  try {
+    const authToken = request.headers.get('authorization')?.replace('Bearer ', '')
+    if (!authToken) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const claims = await verifyAuthToken(authToken)
+    if (!claims) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const user = await prisma.user.findUnique({ where: { privyId: claims.userId } })
+    if (!user) {
+      return NextResponse.json({ error: 'User not found' }, { status: 404 })
+    }
+
+    const where = { userId: user.id, type: 'withdrawal' }
+
+    const [total, completed, pending, failed] = await Promise.all([
+      prisma.transaction.aggregate({
+        where,
+        _count: { id: true },
+        _sum: { amount: true },
+      }),
+      prisma.transaction.aggregate({
+        where: { ...where, status: 'completed' },
+        _count: { id: true },
+        _sum: { amount: true },
+      }),
+      prisma.transaction.count({ where: { ...where, status: 'pending' } }),
+      prisma.transaction.count({ where: { ...where, status: 'failed' } }),
+    ])
+
+    return NextResponse.json({
+      withdrawals: {
+        totalCount: total._count.id,
+        totalAmount: Number(total._sum.amount ?? 0),
+        completedCount: completed._count.id,
+        completedAmount: Number(completed._sum.amount ?? 0),
+        pendingCount: pending,
+        failedCount: failed,
+        currency: 'USDC',
+      },
+    })
+  } catch (error) {
+    logger.error({ err: error }, 'Routes B analytics withdrawals GET error')
+    return NextResponse.json({ error: 'Failed to get withdrawal stats' }, { status: 500 })
+  }
+}

app/api/routes-b/audit-log/[id]/route.ts

@@ -0,0 +1,43 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { prisma } from '@/lib/db'
+import { verifyAuthToken } from '@/lib/auth'
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const { id } = await params
+
+  const authToken = request.headers.get('authorization')?.replace('Bearer ', '')
+  const claims = await verifyAuthToken(authToken || '')
+  if (!claims) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const user = await prisma.user.findUnique({ where: { privyId: claims.userId } })
+  if (!user) {
+    return NextResponse.json({ error: 'User not found' }, { status: 404 })
+  }
+
+  const event = await prisma.auditEvent.findUnique({ where: { id } })
+
+  if (!event) {
+    return NextResponse.json({ error: 'Audit event not found' }, { status: 404 })
+  }
+
+  if (event.actorId !== user.id) {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+
+  return NextResponse.json({
+    event: {
+      id: event.id,
+      action: event.eventType,
+      resourceType: 'invoice',
+      resourceId: event.invoiceId,
+      ipAddress: null,
+      userAgent: null,
+      createdAt: event.createdAt,
+    },
+  })
+}

app/api/routes-b/bank-accounts/[id]/route.ts

@@ -4,8 +4,9 @@ import { verifyAuthToken } from "@/lib/auth";
 
 export async function GET(
   request: NextRequest,
-  { params }: { params: { id: string } },
+  { params }: { params: Promise<{ id: string }> },
 ) {
+  const { id } = await params;
   const authToken = request.headers
     .get("authorization")
     ?.replace("Bearer ", "");
@@ -23,7 +24,7 @@ export async function GET(
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
 
   const bankAccount = await prisma.bankAccount.findUnique({
-    where: { id: params.id },
+    where: { id },
   });
 
   if (!bankAccount)

app/api/routes-b/bank-accounts/route.ts

@@ -7,6 +7,7 @@ function isValidDigits(value: string, min: number, max: number) {
   return pattern.test(value)
 }
 
+/** Lists the authenticated user's saved bank accounts (default account first). */
 export async function GET(request: NextRequest) {
   const authToken = request.headers.get('authorization')?.replace('Bearer ', '')
   const claims = await verifyAuthToken(authToken || '')