Feature: Implement REST API for Redaction Service

[matthewgoluba]

Create a standalone Bun HTTP server that can accept external requests for redaction. This allows tools like Tampermonkey scripts or internal dashboards to utilize the redaction engine programmatically.

Architecture:

• Standalone Bun HTTP server in packages/api/
• Works on-prem and can be deployed to Vercel
• No Next.js - pure Bun native HTTP

Requirements:

• Endpoint: POST /api/redact
• Payload: JSON object { text: string, config?: object, preset?: string }
• Response: JSON object { redactedText: string, stats: {...}, mapping: {...} }
• CORS: Must be configured to allow requests from external origins (for browser scripts)

Tasks:

• Create packages/api/server.ts with Bun.serve()
• Implement POST /api/redact endpoint
• Implement GET /api/health endpoint for monitoring
• Add CORS middleware/headers
• Implement error handling for malformed JSON
• Add bun api script to package.json

[goobz22]

Implementation Notes Based on Codebase Review

Current State

• No API routes exist - UI is 100% client-side
• UI framework: Next.js 16.0.1 with App Router
• Core engine imports: DataRedactor, DEFAULT_CONFIG from data-redactor-core

Suggested Implementation

1. Create packages/ui/app/api/redact/route.ts:

import { NextRequest, NextResponse } from 'next/server';
import { DataRedactor } from 'data-redactor-core';

export async function POST(request: NextRequest) {
  try {
    const { text, config } = await request.json();
    
    if (!text || typeof text !== 'string') {
      return NextResponse.json(
        { error: 'Missing or invalid "text" field' },
        { status: 400 }
      );
    }
    
    const redactor = new DataRedactor(config);
    const result = redactor.redact(text);
    
    return NextResponse.json({
      redactedText: result.redactedText,
      stats: {
        matchCount: result.matches.length,
        typesFound: [...new Set(result.matches.map(m => m.type))]
      }
    });
  } catch (error) {
    return NextResponse.json(
      { error: 'Invalid request body' },
      { status: 400 }
    );
  }
}

2. Create packages/ui/app/api/health/route.ts:

import { NextResponse } from 'next/server';

export async function GET() {
  return NextResponse.json({ status: 'ok', timestamp: Date.now() });
}

3. CORS Configuration in next.config.ts:

async headers() {
  return [
    {
      source: '/api/:path*',
      headers: [
        { key: 'Access-Control-Allow-Origin', value: '*' },
        { key: 'Access-Control-Allow-Methods', value: 'GET, POST, OPTIONS' },
        { key: 'Access-Control-Allow-Headers', value: 'Content-Type' },
      ],
    },
  ];
}

Additional Suggestions

• Add rate limiting middleware for production
• Consider adding GET /api/patterns to list available pattern types
• The config parameter should accept preset names (ties into Issue Feature: Add 'AI Compliance' Strict Configuration Preset #4)

[goobz22]

Implementation Complete

Created Bun HTTP API server in packages/api/server.ts:

Endpoints

• POST /api/redact - Redact text with optional config/preset
• GET /api/health - Health check
• GET/POST/DELETE /api/feedback - Feedback CRUD operations
• GET /api/presets - List available presets

Files Created

• packages/api/server.ts - Main Bun.serve() server
• packages/api/routes/feedback.ts - Feedback route handlers
• packages/api/db/client.ts - PostgreSQL client
• packages/api/db/schema.sql - Database migration

Scripts Added

• bun run api - Start API server on port 3001
• bun run db:migrate - Run database migrations

Ready to close.