CRUD API: Supabase + Server Actions

[Server Action 우선]
- Form submit (POST/PATCH/DELETE)
- 같은 도메인 클라이언트만 호출
- 자동 CSRF 보호

[Route Handler 사용]
- 외부 통합 (Webhook, Mobile App)
- GET (URL 직접 접근)
- 파일 업로드 multipart

// src/app/(app)/generate/actions.ts
'use server'
import { z } from 'zod'
import { revalidatePath } from 'next/cache'
import { redirect } from 'next/navigation'
import { createClient } from '@/lib/supabase/server'
import { rateLimit } from '@/lib/rate-limit'
import { generateAI } from '@/lib/ai'

const schema = z.object({
  prompt: z.string().min(1).max(500),
  template_id: z.string().uuid().optional(),
})

export async function createGeneration(prevState: any, formData: FormData) {
  const supabase = await createClient()
  const { data: { user } } = await supabase.auth.getUser()
  if (!user) return { error: '로그인 필요' }

  // Rate limit (분당 10회)
  const rl = await rateLimit(`gen:${user.id}`, 10, 60)
  if (!rl.success) return { error: '분당 10회 초과', retry_after: rl.reset }

  // 사용량 체크 (무료 5/월)
  const { count } = await supabase
    .from('generations')
    .select('*', { count: 'exact', head: true })
    .eq('user_id', user.id)
    .gte('created_at', new Date(Date.now() - 30 * 86400e3).toISOString())

  const { data: sub } = await supabase
    .from('subscriptions')
    .select('plan')
    .eq('user_id', user.id)
    .single()

  if ((sub?.plan ?? 'free') === 'free' && (count ?? 0) >= 5) {
    return { error: '무료 5회 한도 초과', upgrade: '/pricing' }
  }

  // 검증
  const parsed = schema.safeParse({
    prompt: formData.get('prompt'),
    template_id: formData.get('template_id') || undefined,
  })
  if (!parsed.success) return { error: '입력값 오류', details: parsed.error.errors }

  // AI 호출
  const result = await generateAI(parsed.data.prompt)

  // DB 저장
  const { data, error } = await supabase
    .from('generations')
    .insert({
      user_id: user.id,
      prompt: parsed.data.prompt,
      result: result.text,
      tokens_used: result.tokens,
    })
    .select()
    .single()

  if (error) return { error: error.message }

  revalidatePath('/history')
  redirect(`/history/${data.id}`)
}

'use server'
export async function updateGeneration(id: string, prompt: string) {
  const supabase = await createClient()
  const { data: { user } } = await supabase.auth.getUser()
  if (!user) return { error: '로그인 필요' }

  const { error } = await supabase
    .from('generations')
    .update({ prompt })
    .eq('id', id)
    .eq('user_id', user.id)  // 본인만

  if (error) return { error: error.message }
  revalidatePath('/history')
  return { success: true }
}

export async function deleteGeneration(id: string) {
  const supabase = await createClient()
  const { data: { user } } = await supabase.auth.getUser()
  if (!user) return

  await supabase
    .from('generations')
    .delete()
    .eq('id', id)
    .eq('user_id', user.id)

  revalidatePath('/history')
}

// src/app/api/generations/route.ts
import { NextResponse } from 'next/server'
import { createClient } from '@/lib/supabase/server'

export async function GET(request: Request) {
  const { searchParams } = new URL(request.url)
  const cursor = searchParams.get('cursor')

  const supabase = await createClient()
  const { data: { user } } = await supabase.auth.getUser()
  if (!user) return NextResponse.json({ error: 'unauthorized' }, { status: 401 })

  let q = supabase.from('generations').select('*').order('created_at', { ascending: false }).limit(20)
  if (cursor) q = q.lt('created_at', cursor)

  const { data } = await q
  const nextCursor = data?.[data.length - 1]?.created_at ?? null

  return NextResponse.json({
    data,
    meta: { cursor: nextCursor, has_more: data?.length === 20 },
  })
}

pnpm add @upstash/redis @upstash/ratelimit

// src/lib/rate-limit.ts
import { Ratelimit } from '@upstash/ratelimit'
import { Redis } from '@upstash/redis'

const redis = Redis.fromEnv()

export async function rateLimit(key: string, limit: number, windowSec: number) {
  const rl = new Ratelimit({
    redis,
    limiter: Ratelimit.slidingWindow(limit, `${windowSec} s`),
  })
  return await rl.limit(key)
}