Add rate limiting, security headers, fix CORS for production

lib/api.ts

@@ -0,0 +1,84 @@
+const BASE_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:3001';
+
+async function apiFetch<T>(path: string, options?: RequestInit): Promise<T> {
+  const res = await fetch(`${BASE_URL}${path}`, {
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...(options?.headers ?? {}),
+    },
+    next: { revalidate: 30 },
+  });
+  if (!res.ok) throw new Error(`API error ${res.status}: ${path}`);
+  return res.json() as Promise<T>;
+}
+
+export interface Stat {
+  owlCount: number;
+  burrowCount: number;
+  volunteerHours: number;
+  activeStreams: number;
+}
+
+export interface Stream {
+  id: string;
+  name: string;
+  location: string;
+  status: 'live' | 'offline';
+  viewerCount: number;
+  thumbnailUrl?: string;
+  hlsUrl?: string;
+  description?: string;
+}
+
+export interface Wildlife {
+  id: string;
+  name: string;
+  scientificName: string;
+  status: string;
+  description: string;
+  habitat: string;
+  imageUrl?: string;
+}
+
+export interface Campaign {
+  id: string;
+  title: string;
+  description: string;
+  goal: number;
+  raised: number;
+  imageUrl?: string;
+}
+
+export interface Event {
+  id: string;
+  title: string;
+  date: string;
+  location: string;
+  description: string;
+  rsvpCount: number;
+  capacity?: number;
+}
+
+export interface Burrow {
+  id: string;
+  lat: number;
+  lng: number;
+  name?: string;
+  active: boolean;
+}
+
+export const api = {
+  getStats: () => apiFetch<Stat>('/api/stats'),
+  getStreams: () => apiFetch<Stream[]>('/api/streams'),
+  getStream: (id: string) => apiFetch<Stream>(`/api/streams/${id}`),
+  getWildlife: () => apiFetch<Wildlife[]>('/api/wildlife'),
+  getCampaigns: () => apiFetch<Campaign[]>('/api/campaigns'),
+  getEvents: () => apiFetch<Event[]>('/api/events'),
+  rsvpEvent: (id: string, email: string) =>
+    apiFetch(`/api/events/${id}/rsvp`, {
+      method: 'POST',
+      body: JSON.stringify({ email }),
+    }),
+  getBurrows: () => apiFetch<Burrow[]>('/api/burrows'),
+};