fix: proxy history audio, order answers, secure recording endpoint

- History tab audio now routes through /api/recording proxy (was raw)
- API orders answers by orderIndex for consistent display
- Recording proxy validates user access before serving audio
- Remove unused lang variable

Author: Sonra0

src/app/api/elderly/[id]/assessment/route.ts

@@ -25,7 +25,7 @@ export async function GET(
 
   const sessions = await prisma.assessmentSession.findMany({
     where: { elderlyProfileId: id },
-    include: { answers: true },
+    include: { answers: { orderBy: { orderIndex: "asc" } } },
     orderBy: { createdAt: "desc" },
     take: 30,
   });

src/app/api/recording/route.ts

@@ -1,12 +1,43 @@
 import { NextRequest, NextResponse } from "next/server";
+import { getCurrentUser } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
 
 export async function GET(req: NextRequest) {
-  const url = req.nextUrl.searchParams.get("url");
+  const user = await getCurrentUser();
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
 
+  const url = req.nextUrl.searchParams.get("url");
   if (!url || !url.includes("twilio.com")) {
     return NextResponse.json({ error: "Invalid URL" }, { status: 400 });
   }
 
+  // Verify the recording belongs to a session the user has access to
+  const answer = await prisma.assessmentAnswer.findFirst({
+    where: { recordingUrl: url },
+    include: {
+      session: {
+        include: {
+          elderlyProfile: {
+            include: { caregivers: true },
+          },
+        },
+      },
+    },
+  });
+
+  if (!answer) {
+    return NextResponse.json({ error: "Recording not found" }, { status: 404 });
+  }
+
+  const profile = answer.session.elderlyProfile;
+  const hasAccess =
+    profile.managerId === user.id ||
+    profile.caregivers.some((c: { userId: string | null }) => c.userId === user.id);
+
+  if (!hasAccess) {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
   try {
     const authHeader = `Basic ${Buffer.from(
       `${process.env.TWILIO_ACCOUNT_SID}:${process.env.TWILIO_AUTH_TOKEN}`
@@ -18,7 +49,7 @@ export async function GET(req: NextRequest) {
     });
 
     if (!response.ok) {
-      return NextResponse.json({ error: "Recording not found" }, { status: 404 });
+      return NextResponse.json({ error: "Recording not available" }, { status: 404 });
     }
 
     const buffer = Buffer.from(await response.arrayBuffer());

src/app/elderly/[id]/assessment/page.tsx

@@ -607,7 +607,7 @@ export default function AssessmentPage() {
                             {a.recordingUrl && (
                               <div className="ml-5 mt-1">
                                 <audio controls preload="none" className="h-7 w-full max-w-xs">
-                                  <source src={a.recordingUrl} type="audio/mpeg" />
+                                  <source src={`/api/recording?url=${encodeURIComponent(a.recordingUrl)}`} type="audio/mpeg" />
                                 </audio>
                               </div>
                             )}

src/lib/assessment-call.ts

@@ -61,7 +61,6 @@ export async function executeAssessmentCall(sessionId: string) {
     const q1Url = questionUrls[0];
 
     const baseUrl = process.env.NEXT_PUBLIC_APP_URL;
-    const lang = profile.language === "ar" ? "ar-SA" : "en-US";
 
     const twiml = `<Response>
       <Play>${greetingUrl}</Play>