fix(api/offers): return Content-Type: application/json

The GET /api/offers route at packages/web/src/app/api/(server)/offers/route.ts returned a JSON body but the response was served with Content-Type: text/plain;charset=UTF-8 because new Response(JSON.stringify(offers)) does not set a content type. Node.js / Next.js default the content type to text/plain for a string body, even when the body is JSON.

This is the only public API route in packages/web/src/app/api/(server)/ that uses new Response(JSON.stringify(...)) without setting Content-Type. Every other public JSON route — /api/health, /api/version, /api/blame, /api/source, /api/connections, /api/ee/audit, /api/ee/scoped_access_token — uses Response.json(...) or sets the header explicitly. The OpenAPI spec for /api/offers already declares the response as application/json, so the actual response was violating the documented contract.

Strict API clients (CLI tools, OpenAPI-generated SDKs, third-party integrations) inspect Content-Type before parsing. A client that sees text/plain;charset=UTF-8 will refuse to parse the body even though it is valid JSON. The in-app getOffers client happens to work because response.json() ignores Content-Type, but that is a coincidence of the Web fetch API, not because the response is correct.

Fix: add 'Content-Type': 'application/json' to the response headers. One-line change, body unchanged, no client broken.

Also added route.test.ts with 3 vitest cases (status 200 + JSON body, Content-Type: application/json, Cache-Control header preserved). The OTel suite-load error and posthog import are mocked the same way other tests in this repo handle them.

Fixes #1595

Author: Harsh23Kashyap

packages/web/src/app/api/(server)/offers/route.test.ts

@@ -0,0 +1,72 @@
+import { NextRequest } from "next/server";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+    env: {
+        SOURCEBOT_INSTALL_ID: "test-install-id",
+    },
+    offers: [
+        { id: "team-monthly", name: "Team", price: { monthly: 100, yearly: 1000 } },
+        { id: "enterprise-monthly", name: "Enterprise", price: { monthly: 500, yearly: 5000 } },
+    ] as unknown,
+}));
+
+vi.mock("@sourcebot/shared", () => ({
+    env: mocks.env,
+    createLogger: () => ({
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+    }),
+}));
+
+vi.mock("@/features/billing/client", () => ({
+    client: {
+        offers: vi.fn().mockResolvedValue(mocks.offers),
+    },
+}));
+
+vi.mock("@opentelemetry/sdk-trace-base", () => ({
+    getEnv: () => ({}),
+    TraceIdRatioBasedSampler: vi.fn(),
+    ParentBasedSampler: vi.fn(),
+    AlwaysOnSampler: vi.fn(),
+    AlwaysOffSampler: vi.fn(),
+}));
+
+vi.mock("@/lib/posthog", () => ({
+    captureEvent: vi.fn(),
+}));
+
+import { GET } from "./route";
+
+const makeRequest = () => new NextRequest("https://example.com/api/offers");
+
+describe("GET /api/offers", () => {
+    afterEach(() => {
+        vi.clearAllMocks();
+    });
+
+    it("returns a 200 with the offers as JSON", async () => {
+        const response = await GET(makeRequest(), {});
+        expect(response.status).toBe(200);
+
+        const body = await response.json();
+        expect(body).toEqual(mocks.offers);
+    });
+
+    it("sets Content-Type: application/json", async () => {
+        const response = await GET(makeRequest(), {});
+        // Next.js / Web Headers are case-insensitive, but be defensive
+        const contentType = response.headers.get("Content-Type") ?? response.headers.get("content-type") ?? "";
+        expect(contentType).toContain("application/json");
+    });
+
+    it("preserves the public cache-control header", async () => {
+        const response = await GET(makeRequest(), {});
+        const cacheControl = response.headers.get("Cache-Control") ?? "";
+        expect(cacheControl).toContain("public");
+        expect(cacheControl).toContain("max-age=300");
+    });
+});

packages/web/src/app/api/(server)/offers/route.ts

@@ -10,6 +10,7 @@ export const GET = apiHandler(async () => {
 
     return new Response(JSON.stringify(offers), {
         headers: {
+            'Content-Type': 'application/json',
             'Cache-Control': 'public, max-age=300'
         }
     });