Add ISAC mechanic gap handoff actions

src/routes/api/isac/mechanic-gap-report/+server.ts

@@ -0,0 +1,46 @@
+import { getSessionUser } from '$lib/server/auth/session';
+import { requirePermission } from '$lib/server/auth/authorization';
+import {
+	MechanicGapReportError,
+	parseMechanicGapReport,
+	submitMechanicGapReport
+} from '$lib/server/ai/mechanic-gap-report';
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+
+const MAX_REQUEST_BYTES = 100_000;
+
+export const POST: RequestHandler = async ({ cookies, request, url }) => {
+	const operator = await requirePermission(
+		await getSessionUser(cookies),
+		'ai.mechanic.generate'
+	);
+	const origin = request.headers.get('origin');
+	if (origin && origin !== url.origin) {
+		return json({ message: 'Cross-origin mechanic gap reports are not allowed.' }, { status: 403 });
+	}
+	const contentLength = Number(request.headers.get('content-length') ?? 0);
+	if (Number.isFinite(contentLength) && contentLength > MAX_REQUEST_BYTES) {
+		return json({ message: 'The mechanic gap report is too large.' }, { status: 413 });
+	}
+	try {
+		const body = await request.text();
+		if (Buffer.byteLength(body, 'utf8') > MAX_REQUEST_BYTES) {
+			return json({ message: 'The mechanic gap report is too large.' }, { status: 413 });
+		}
+		const report = parseMechanicGapReport(JSON.parse(body));
+		return json(await submitMechanicGapReport(operator.id, report));
+	} catch (caught) {
+		if (caught instanceof SyntaxError) {
+			return json({ message: 'The mechanic gap report must be valid JSON.' }, { status: 400 });
+		}
+		if (caught instanceof MechanicGapReportError) {
+			return json({ message: caught.message }, { status: caught.status });
+		}
+		console.error('Mechanic gap report submission failed.', caught);
+		return json(
+			{ message: 'The mechanic gap could not be submitted to the admin team.' },
+			{ status: 500 }
+		);
+	}
+};