shivam + claude changes

app/api/analytics/route.ts

@@ -1,30 +1,37 @@
 import { NextResponse } from 'next/server';
 
+const ANALYTICS_KEY = process.env.ANALYTICS_KEY || 'default-analytics-key';
+
 export async function POST(req: Request) {
     try {
+        const analyticsKey = req.headers.get('X-Analytics-Key');
+        if (analyticsKey !== ANALYTICS_KEY) {
+            return NextResponse.json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+
         const body = await req.json();
+
+        if (typeof body.path !== 'string' || typeof body.timestamp !== 'number') {
+            return NextResponse.json({ success: false, error: 'Invalid input' }, { status: 400 });
+        }
+
         const headers = req.headers;
+        const forwarded = headers.get('x-forwarded-for');
+        const ip = forwarded ? forwarded.split(',')[0].trim() : 'unknown';
 
-        // Get IP here since we are the public facing entity
-        const ip = headers.get('x-forwarded-for') || 'unknown';
-
-        // Relay to Admin Dashboard (Internal Docker Network)
-        // admin_dash must be reachable. If in same docker network, use container name.
-        // If separate, use host.docker.internal or configured URL.
         const adminUrl = process.env.ADMIN_DASH_URL || 'http://admin_dash:3000/api/track';
 
-        // We fire and forget - don't wait for response to keep this fast
         fetch(adminUrl, {
             method: 'POST',
-            body: JSON.stringify({ ...body, ip }), // Pass IP along
+            body: JSON.stringify({ path: body.path, timestamp: body.timestamp, ip }),
             headers: {
                 'Content-Type': 'application/json',
-                'X-Forwarded-For': ip // Preserve IP
+                'X-Forwarded-For': ip,
             },
         }).catch(e => console.error('Relay failed', e));
 
         return NextResponse.json({ success: true });
-    } catch (error) {
-        return NextResponse.json({ success: false });
+    } catch {
+        return NextResponse.json({ success: false, error: 'Bad request' }, { status: 400 });
     }
 }