feat: rediseño UI completo + infra email + stats

api/routes/stats.js

@@ -0,0 +1,55 @@
+'use strict';
+
+const { get } = require('../services/stats');
+
+// Whitelist estricta: solo claves conocidas salen en la respuesta
+const PROVIDER_LABELS = {
+  instagram:  'Instagram',
+  facebook:   'Facebook',
+  twitter_x:  'X (Twitter)',
+  linkedin:   'LinkedIn',
+  tiktok:     'TikTok',
+  snapchat:   'Snapchat',
+  microsoft:  'Microsoft',
+  apple:      'Apple',
+  google:     'Google',
+  amazon:     'Amazon',
+  reddit:     'Reddit',
+  discord:    'Discord',
+};
+
+const VALID_DATE = /^\d{4}-\d{2}-\d{2}$/;
+
+function safeInt(v) {
+  const n = Math.floor(Number(v));
+  return Number.isFinite(n) && n >= 0 ? n : 0;
+}
+
+module.exports = (req, res) => {
+  const raw = get();
+
+  // Solo proveedores de la whitelist — cualquier clave extraña en stats.json se descarta
+  const providers = Object.entries(raw.by_provider || {})
+    .filter(([key]) => Object.prototype.hasOwnProperty.call(PROVIDER_LABELS, key))
+    .map(([key, v]) => ({
+      name:       PROVIDER_LABELS[key],          // nombre viene de whitelist, no del fichero
+      icon_key:   key,                           // clave corta para iconos en cliente (solo a-z_)
+      sent:       safeInt(v.sent),
+      redirected: safeInt(v.redirected),
+      total:      safeInt(v.sent) + safeInt(v.redirected),
+    }))
+    .sort((a, b) => b.total - a.total);
+
+  // updated: solo si es una fecha válida YYYY-MM-DD, si no null
+  const updated = typeof raw.updated === 'string' && VALID_DATE.test(raw.updated)
+    ? raw.updated
+    : null;
+
+  res.json({
+    total_sent:       safeInt(raw.total_sent),
+    total_redirected: safeInt(raw.total_redirected),
+    total_searches:   safeInt(raw.total_searches),
+    providers,
+    updated,
+  });
+};