API Updates

app/api/dashboard/stats/route.ts

@@ -2,10 +2,17 @@ import { NextResponse } from "next/server";
 import { auth } from "@/auth";
 import { db } from "@/lib/db";
 
-export async function GET() {
-  const session = await auth();
-  if (!session?.user) {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+export async function GET(req: Request) {
+  // Accept either a logged-in session or the shared display API key
+  const displayKey = process.env.DISPLAY_API_KEY;
+  const providedKey = req.headers.get("x-display-key");
+  const isDisplayDevice = displayKey && providedKey === displayKey;
+
+  if (!isDisplayDevice) {
+    const session = await auth();
+    if (!session?.user) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
   }
 
   const [

app/api/display/events/route.ts

@@ -0,0 +1,31 @@
+import { NextResponse } from "next/server";
+import { db } from "@/lib/db";
+
+function isAuthorized(req: Request): boolean {
+  const key = process.env.DISPLAY_API_KEY;
+  if (!key) return false; // key must be set
+  return req.headers.get("x-display-key") === key;
+}
+
+export async function GET(req: Request) {
+  if (!isAuthorized(req)) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const { searchParams } = new URL(req.url);
+  const after = parseInt(searchParams.get("after") ?? "0", 10);
+
+  // Prune events older than 24 h — fire and forget
+  db.displayEvent
+    .deleteMany({ where: { createdAt: { lt: new Date(Date.now() - 86_400_000) } } })
+    .catch(() => {});
+
+  const events = await db.displayEvent.findMany({
+    where: { id: { gt: after } },
+    orderBy: { id: "asc" },
+    take: 10,
+    select: { id: true, type: true, shotCode: true, by: true },
+  });
+
+  return NextResponse.json(events);
+}