fix(cron): run LoTW sync in-process instead of self-fetching localhost

[patrickrb]

Problem

The unified sync cron (/api/cron/sync) invoked the LoTW upload/download API routes by fetching NEXTAUTH_URL || http://localhost:3000. In serverless deployments nothing listens on localhost inside the function, so every LoTW leg failed:

Error processing LoTW upload for station K1AF: TypeError: fetch failed
  [cause]: Error: connect ECONNREFUSED 127.0.0.1:3000

Even with NEXTAUTH_URL set, the self-fetch pattern doubles invocations and depends on the deployment's public URL being reachable from inside the cron function.

Fix

• New src/lib/lotw-sync.ts — the full upload/download logic extracted from the two API routes into performLotwUpload() / performLotwDownload(). Each takes stationId plus an optional requesterUserId: when present (user-facing API path) the station must belong to that user; when omitted (cron path) the station's own user_id scopes logging and contacts. Returns { status, body } so routes pass results straight to NextResponse.json — response shapes and status codes are unchanged.
• /api/cron/sync — callLotwRoute() (the self-fetch) is deleted; the LoTW legs call the lib in-process. No more NEXTAUTH_URL dependency.
• /api/lotw/upload + /api/lotw/download — now thin wrappers: verifyToken, validate station_id, delegate. The X-Cron-Job cron mode is removed entirely since its only caller now runs in-process; the routes always require a user token. GET log-listing handlers unchanged.

The download lib carries over the recent sync-overhaul improvements verbatim (incremental fetch via lotw_last_qsl_rcvd_date, per-row confirmation apply isolation, single qsl_lotw_date assignment).

Verification

• npm run typecheck, npm run lint, npm run build all pass.
• Live smoke test against dev server: /api/cron/sync returns 401 with no/wrong Bearer token; /api/lotw/upload and /api/lotw/download return 401 with a spoofed X-Cron-Job: true header.
• Full upload path not exercised live (would push real QSOs to ARRL LoTW).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nodelog	Ready	Preview, Comment	Jul 13, 2026 9:39pm

[Copilot]

Pull request overview

Refactors the LoTW sync implementation so the unified cron (/api/cron/sync) runs LoTW upload/download logic in-process rather than self-fetching the app over HTTP (via NEXTAUTH_URL/localhost), which fails in serverless deployments and doubles invocations.

Changes:

• Extracts LoTW upload/download logic into a shared library (performLotwUpload / performLotwDownload) returning { status, body } for direct route/cron consumption.
• Updates LoTW upload/download API routes to become thin, user-token-only wrappers around the shared library.
• Updates the unified cron to call the shared library directly (removing the internal HTTP fetch helper).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
src/lib/lotw-sync.ts	New shared in-process LoTW upload/download implementation used by both cron and user routes.
src/app/api/lotw/upload/route.ts	Removes cron-mode logic; delegates POST handling to performLotwUpload after verifyToken.
src/app/api/lotw/download/route.ts	Removes cron-mode logic; delegates POST handling to performLotwDownload after verifyToken.
src/app/api/cron/sync/route.ts	Removes self-fetch (NEXTAUTH_URL/localhost) pattern; invokes LoTW sync library functions directly.