API Routes Overview

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• app/api/prs/route.ts
• app/api/task/route.ts
• app/api/merge/route.ts
• app/api/review/route.ts
• app/api/auth/route.ts
• app/api/chat/route.ts
• middleware.ts
• lib/auth.ts

The API Routes in the GeNCorE Command Center provide a backend-for-frontend layer that interfaces primarily with the GitHub REST API v3 and the Anthropic Claude API. These routes enable management of AI agents (Copilot, Claude, Codex) by facilitating operations such as task creation via GitHub Issues, Pull Request (PR) listing, PR reviewing, and merging.

All internal API routes are protected by a session-based authentication system enforced through Next.js middleware, ensuring that sensitive operations and environment-stored tokens (like GITHUB_TOKEN) are never exposed to the client side directly.

Sources: README.md:14-22, README.md:100-108, middleware.ts:1-60

Authentication and Security Architecture

The system uses a multi-layered security approach. Access to API routes (except /api/auth) is restricted by a middleware that checks for a valid auth cookie containing an HMAC-SHA256 hash of the ADMIN_TOKEN.

Authentication Flow

The /api/auth route handles login by verifying a provided token against the server-side ADMIN_TOKEN. Upon success, it issues a secure, HTTP-only cookie.

The authentication mechanism ensures that the raw ADMIN_TOKEN is never stored in the browser.
Sources: app/api/auth/route.ts:7-44, lib/auth.ts:13-25, middleware.ts:25-56

Core GitHub API Integrations

The primary purpose of the API is to orchestrate GitHub repository actions. These routes utilize the GITHUB_TOKEN environment variable to authenticate with the GitHub REST API.

Endpoint	Method	Input Parameters	GitHub Endpoint Targeted
/api/prs	GET	N/A	/repos/{owner}/{repo}/pulls
/api/task	POST	agent, description	/repos/{owner}/{repo}/issues
/api/merge	POST	prNumber, mergeMethod	/repos/{owner}/{repo}/pulls/{num}/merge
/api/review	POST	prNumber, event, body	/repos/{owner}/{repo}/pulls/{num}/reviews

Sources: app/api/prs/route.ts:15-25, app/api/task/route.ts:51-65, app/api/merge/route.ts:40-54, app/api/review/route.ts:45-59

Task Creation (/api/task)

This route creates a new GitHub Issue assigned to a specific AI agent. It maps the internal agent ID to a specific GitHub login and applies predefined labels.

Pull Request Management

Two routes specifically handle the lifecycle of Pull Requests:

• /api/review: Allows users to APPROVE, REQUEST_CHANGES, or COMMENT on a PR. It enforces that a comment body is provided for any event other than approval.
• /api/merge: Executes a PR merge. It supports merge, squash, and rebase methods, defaulting to squash. It includes a critical validation step to ensure prNumber is a safe integer to prevent SSRF attacks.

Sources: app/api/review/route.ts:32-43, app/api/merge/route.ts:25-38

AI Agent Communication (/api/chat)

The /api/chat route provides a direct interface to the Anthropic Claude API (specifically the claude-sonnet-4-6 model). Unlike the GitHub routes which use a server-side GITHUB_TOKEN, this route expects an x-api-key header from the client.

Chat Implementation Details

• Validation: It strictly validates the API key format (must start with sk-ant-) and the message array structure (roles must be user or assistant).
• Payload: It maps the input messages to the Anthropic SDK format and limits the response to 4096 tokens.

Sources: app/api/chat/route.ts:21-70

Configuration and Environment

The API routes rely on several environment variables for routing and authentication.

Variable	Description	Default / Source
GITHUB_TOKEN	PAT for GitHub API access	Required (Server-only)
ADMIN_TOKEN	Password for Command Center access	Required (Server-only)
NEXT_PUBLIC_REPO_OWNER	Target repository owner	marekdkropiewnicki-dotcom
NEXT_PUBLIC_REPO_NAME	Target repository name	GentelmeN-CorE

Sources: README.md:58-63, app/api/prs/route.ts:3-5

Conclusion

The API layer of the GeNCorE Command Center acts as a secure proxy for GitHub and AI agent operations. By centralizing logic such as PR validation, agent mapping, and session management on the server side, the system maintains a slim, mobile-optimized frontend while ensuring sensitive credentials remain protected. Significant emphasis is placed on security through HMAC cookie signing and input sanitization to prevent common web vulnerabilities like SSRF.