feat: tablero de modulo con uso real (equipo helpdesk, pagos validados, inventario API en dashboard)

src/app/api/portal/pagos-validados/route.ts

@@ -0,0 +1,44 @@
+import { NextResponse } from "next/server";
+import { assertIT } from "@/lib/correo-server";
+
+// Pagos validados reales: proxy server-side a
+// GET /api/Boletas/payments?mes=&year= (endpoint público de SAM.API,
+// no requiere Bearer). Requiere sesión IT para verlo en el portal.
+const SAM_API_URL =
+  process.env.SAM_API_URL ??
+  process.env.NEXT_PUBLIC_API_URL ??
+  "https://api.devops.norteamericano.cl";
+
+export async function GET(req: Request): Promise<Response> {
+  try {
+    await assertIT(req);
+    const url = new URL(req.url);
+    const now = new Date();
+    const mes = url.searchParams.get("mes") ?? String(now.getMonth() + 1);
+    const year = url.searchParams.get("year") ?? String(now.getFullYear());
+    const m = Number(mes);
+    const y = Number(year);
+    if (!Number.isInteger(m) || m < 1 || m > 12 || !Number.isInteger(y) || y < 2000 || y > 2100) {
+      return NextResponse.json({ error: "mes (1-12) y year válidos requeridos" }, { status: 400 });
+    }
+    const res = await fetch(
+      `${SAM_API_URL}/api/Boletas/payments?mes=${m}&year=${y}`,
+      { cache: "no-store" }
+    );
+    const text = await res.text();
+    try {
+      return NextResponse.json(JSON.parse(text), { status: res.status });
+    } catch {
+      return new NextResponse(text, { status: res.status });
+    }
+  } catch (e) {
+    const status =
+      typeof e === "object" && e !== null && "status" in e
+        ? Number((e as { status: unknown }).status) || 500
+        : 500;
+    return NextResponse.json(
+      { error: e instanceof Error ? e.message : "Error" },
+      { status }
+    );
+  }
+}