Building an AI Travel Itinerary Planner and Multi-Vendor Tour Marketplace: A Technical SaaS Case Study

// app/api/itineraries/stream/route.ts
import { z } from "zod";
import { auth } from "@/lib/auth";
import { prisma } from "@/lib/prisma";
import { getAiProvider } from "@/lib/ai/provider"; // reads decrypted key server-side only
import { assertWithinQuota } from "@/lib/billing/limits";

export const runtime = "nodejs";

const Input = z.object({
  destination: z.string().trim().min(2).max(120),
  startDate: z.coerce.date(),
  endDate: z.coerce.date(),
  budgetUsd: z.number().int().min(0).max(1_000_000),
  interests: z.array(z.string().trim().max(40)).max(10),
});

const SYSTEM_PROMPT = `You are a travel planning assistant.
Return one section per day, formatted as:
## Day N: <title>
- Morning / Afternoon / Evening: activity, area, estimated cost band
Rules: stay within the stated budget, group nearby places,
never invent opening hours or prices, and mark uncertain facts as "verify".`;

export async function POST(req: Request) {
  const session = await auth();
  if (!session?.user?.id) return new Response("Unauthorized", { status: 401 });

  const parsed = Input.safeParse(await req.json().catch(() => null));
  if (!parsed.success || parsed.data.endDate < parsed.data.startDate) {
    return new Response("Invalid input", { status: 400 });
  }
  const input = parsed.data;

  const quota = await assertWithinQuota(session.user.id, "ai_itinerary");
  if (!quota.ok) return new Response("Monthly limit reached", { status: 402 });

  try {
    const provider = await getAiProvider(); // never returns the key to callers
    const stream = provider.streamText({
      system: SYSTEM_PROMPT,
      prompt: JSON.stringify(input), // user data is data, not instructions
      maxOutputTokens: 3000,
      abortSignal: req.signal,
      onFinish: async ({ text }) => {
        await prisma.$transaction([
          prisma.trip.create({
            data: { ownerId: session.user.id, destination: input.destination, rawPlan: text },
          }),
          prisma.usageCounter.upsert({
            where: { userId_period_kind: { userId: session.user.id, period: quota.period, kind: "ai_itinerary" } },
            create: { userId: session.user.id, period: quota.period, kind: "ai_itinerary", used: 1 },
            update: { used: { increment: 1 } },
          }),
        ]);
      },
    });
    return stream.toTextResponse();
  } catch (err) {
    console.error("itinerary_stream_failed", { userId: session.user.id }); // no keys or prompts in logs
    return new Response("Planner unavailable", { status: 503 });
  }
}