Add result and job management APIs

index.ts

@@ -2,9 +2,12 @@ import { routes as templatebuilder, workerPath } from "./packages/templatebuilde
 import { routes as extractor }                   from "./packages/extractor/index";
 import { routes as summarizer }                  from "./packages/summarizer/index";
 import { join } from "node:path";
+import { rm } from "node:fs/promises";
 import { dataPath } from "./deployPaths";
 import {
   addSecurityHeaders,
+  getCsrfCookieName,
+  isAuthenticated,
   isSafeStem,
   login,
   loginPage,
@@ -17,6 +20,9 @@ import {
 const SUMMARIZER_OUTPUTS_DIR =
   process.env.BMP_SUMMARIZER_OUTPUTS_DIR ??
   dataPath(join(import.meta.dir, "packages/summarizer/outputs"), "summarizer", "outputs");
+const EXTRACTOR_OUTPUTS_DIR =
+  process.env.BMP_EXTRACTOR_OUTPUTS_DIR ??
+  dataPath(join(import.meta.dir, "packages/extractor/outputs"), "extractor", "outputs");
 const ROOT_PAGE_PATH = join(import.meta.dir, "index.html");
 const BMP_LOGO_PATH = join(import.meta.dir, "assets/bmp-logo.png");
 const PORT = Number(process.env.PORT ?? 3000);
@@ -74,6 +80,12 @@ Bun.serve({
     "/logout": {
       POST: withAuth(async () => logout(), { csrf: true }),
     },
+    "/api/auth/session": {
+      GET: async (req: Request) => addSecurityHeaders(Response.json({
+        authenticated: await isAuthenticated(req),
+        csrfCookieName: getCsrfCookieName(),
+      })),
+    },
     "/": {
       GET: withAuth(async () => new Response(Bun.file(ROOT_PAGE_PATH), {
         headers: { "Content-Type": "text/html; charset=utf-8" },
@@ -84,6 +96,24 @@ Bun.serve({
         headers: { "Content-Type": "image/png", "Cache-Control": "private, max-age=86400" },
       })),
     },
+    "/api/results/:stem": {
+      DELETE: withAuth(async (req: Request) => {
+        const stem = (req as Request & { params: Record<string, string | undefined> }).params.stem ?? "";
+        if (!isSafeStem(stem)) {
+          return Response.json({ error: "Invalid result id" }, { status: 400 });
+        }
+
+        const targets = [
+          join(EXTRACTOR_OUTPUTS_DIR, stem),
+          join(SUMMARIZER_OUTPUTS_DIR, stem),
+        ];
+        await Promise.all(targets.map((target) => rm(target, { recursive: true, force: true })));
+        return Response.json({ ok: true, stem, deleted: targets.length });
+      }, {
+        csrf: true,
+        limit: { key: "result-delete", max: 20, windowMs: 60_000 },
+      }),
+    },
     "/api/pipeline/result/:stem": {
       GET: withAuth(async (req: Request) => {
         const stem = (req as Request & { params: Record<string, string | undefined> }).params.stem ?? "";