/api/notifications/dispatch · Brand Studio docs

Methods: POST. Input signals: none detected. Literal response-status signals: none detected.

Source: hosted-app/app/api/notifications/dispatch/route.js. Imports: ../../../../lib/notification-outbox.mjs, ../../../../lib/supabase-rest.mjs, next/server, node:crypto. Exact source is shown for inspection; its presence does not prove authentication, validation or live behavior.

All API routes · API and execution contract

import { NextResponse } from 'next/server';
import { timingSafeEqual } from 'node:crypto';
import { supabaseConfigFromEnv } from '../../../../lib/supabase-rest.mjs';
import { drainNotificationOutbox } from '../../../../lib/notification-outbox.mjs';
export const runtime = 'nodejs';
export const dynamic = 'force-dynamic';
export const maxDuration = 60;
export async function POST(request) {
  const expected = process.env.BRAND_STUDIO_NOTIFICATION_WORKER_SECRET || '';
  const supplied = request.headers.get('authorization') || '';
  const equal = expected.length >= 32 && Buffer.byteLength(supplied) === Buffer.byteLength('Bearer ' + expected)
    && timingSafeEqual(Buffer.from(supplied), Buffer.from('Bearer ' + expected));
  const result = equal ? await drainNotificationOutbox({ config: supabaseConfigFromEnv(process.env) })
    : { http_status: expected.length >= 32 ? 401 : 503, body: { status: 'refused', reason: 'notification_worker_not_authorized' } };
  return NextResponse.json(result.body, { status: result.http_status, headers: { 'cache-control': 'no-store' } });
}