Initial commit

app/api/backup/import/route.ts

@@ -0,0 +1,55 @@
+import { NextRequest, NextResponse } from "next/server";
+import path from "node:path";
+import { assertLocalRequest } from "@/lib/api/localOnly";
+import { importDatabaseTables } from "@/lib/backup/importDb";
+
+// Strip absolute-path noise — only the basename is useful to the client
+// and absolute paths leak filesystem layout to anything that pings the
+// API on the local network.
+const baseOnly = (p: string | null | undefined): string | null =>
+  p ? path.basename(p) : null;
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function POST(req: NextRequest) {
+  const blocked = assertLocalRequest(req);
+  if (blocked) return blocked;
+
+  let payload: { tables?: Record<string, unknown[]>; version?: number; app?: string };
+  try {
+    payload = await req.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
+  }
+
+  const tables = payload.tables;
+  if (!tables || typeof tables !== "object") {
+    return NextResponse.json({ error: "Missing 'tables' object" }, { status: 400 });
+  }
+  if (!Array.isArray(tables.actresses) && !Array.isArray(tables.images)) {
+    return NextResponse.json({ error: "Backup payload is missing core tables." }, { status: 400 });
+  }
+
+  const result = await importDatabaseTables(tables);
+  const snapshotName = baseOnly(result.snapshotPath);
+  if (!result.ok) {
+    return NextResponse.json(
+      {
+        error: result.error,
+        snapshotName,
+        hint: snapshotName
+          ? `Live DB rolled back. A pre-import snapshot was saved as ${snapshotName}.`
+          : undefined,
+      },
+      { status: 500 },
+    );
+  }
+
+  return NextResponse.json({
+    ok: true,
+    counts: result.counts,
+    errors: result.errors,
+    snapshotName,
+  });
+}