feat: add user search

app/api/search/users/route.ts

@@ -0,0 +1,49 @@
+/**
+ * Same-origin proxy for the user-search endpoint.
+ *
+ * Pattern mirrors /api/search (content search) — the browser can't talk
+ * to BFF_URL directly (server-only env var; no NEXT_PUBLIC_ prefix), so
+ * the search page fetches this same-origin route and we proxy through
+ * to /api/v1/users/search server-side. Returned payload is sanitized
+ * by the BFF (handle / name / avatar_url only — no email, role, plan).
+ */
+
+import { NextRequest, NextResponse } from "next/server";
+
+const BFF_BASE = process.env.BFF_URL || "http://localhost:8080";
+
+type EmptyShape = {
+  query: string;
+  results: Array<{ handle: string; name: string; avatar_url: string | null }>;
+};
+
+const empty = (q: string): EmptyShape => ({ query: q, results: [] });
+
+export async function GET(request: NextRequest) {
+  const { searchParams } = request.nextUrl;
+  const q = (searchParams.get("q") || "").trim();
+  const limit = searchParams.get("limit") || "20";
+
+  if (!q) {
+    return NextResponse.json(empty(""));
+  }
+
+  try {
+    const url = new URL("/api/v1/users/search", BFF_BASE);
+    url.searchParams.set("q", q);
+    url.searchParams.set("limit", limit);
+
+    const res = await fetch(url.toString(), {
+      headers: { Accept: "application/json" },
+    });
+    if (!res.ok) {
+      return NextResponse.json(empty(q), { status: res.status });
+    }
+    const data = await res.json();
+    // Unwrap BFF envelope: { data: { query, results } } → { query, results }
+    const payload = data.data ?? data;
+    return NextResponse.json(payload);
+  } catch {
+    return NextResponse.json(empty(q), { status: 502 });
+  }
+}