ChatGPT Apps SDK Next.js Starter

import { NextResponse } from "next/server";

export const dynamic = "force-dynamic";

function isAllowedOrigin(origin: string | null) {
  if (!origin) return false;
  if (origin === "https://chatgpt.com") return true;

  try {
    const u = new URL(origin);
    if (u.hostname.endsWith(".web-sandbox.oaiusercontent.com")) return true;
  } catch {}

  return false;
}

function corsHeaders(req: Request) {
  const origin = req.headers.get("origin");
  const allowOrigin = isAllowedOrigin(origin) ? origin! : "*";

  return {
    "Access-Control-Allow-Origin": allowOrigin,
    "Vary": "Origin",
    "Access-Control-Allow-Methods": "GET,POST,OPTIONS",
    "Access-Control-Allow-Headers": "Content-Type, Authorization",
    "Access-Control-Max-Age": "86400",
  };
}

export async function OPTIONS(req: Request) {
  return new Response(null, { status: 204, headers: corsHeaders(req) });
}

export async function GET(req: Request) {
  const base = (process.env.MCP_PUBLIC_URL || "https://atrip-elouise-pantomimically.ngrok-free.dev").replace(/\/+$/, "");
  if (!base) {
    return NextResponse.json(
      { ok: false, message: "Missing MCP_PUBLIC_URL" },
      { status: 500, headers: corsHeaders(req) }
    );
  }

  const { searchParams } = new URL(req.url);
  const id = (searchParams.get("id") || "").trim();

  if (!id) {
    return NextResponse.json(
      { ok: false, message: "Missing id" },
      { status: 400, headers: corsHeaders(req) }
    );
  }

  let upstreamRes: Response;
  let upstreamJson: any = null;

  try {
    upstreamRes = await fetch(`${base}/saju/by-id?id=${encodeURIComponent(id)}`, {
      method: "GET",
      cache: "no-store",
    });

    upstreamJson = await upstreamRes.json().catch(() => null);
  } catch (e: any) {
    return NextResponse.json(
      { ok: false, message: `Upstream fetch failed: ${e?.message || String(e)}` },
      { status: 502, headers: corsHeaders(req) }
    );
  }

  return NextResponse.json(
    upstreamJson ?? { ok: false, message: "Bad upstream response" },
    { status: upstreamRes.status, headers: corsHeaders(req) }
  );
}