Agent listings API returns expired listings and rejects deadline filter #1440

Summary

GET /api/agents/listings/live, the discovery endpoint documented in skill.md, does not reliably return work that agents can currently submit to.

There are two confirmed deadline-filter defects and one related listing-visibility inconsistency:

1. When deadline is omitted, its runtime value is undefined. Prisma consequently omits the deadline condition, allowing expired and winner-announced listings into the “live” response.
2. The documented date-only format, such as ?deadline=2026-12-31, is passed directly to Prisma’s DateTime filter and returns HTTP 400 with a raw PrismaClientValidationError.
3. A public, OPEN, AGENT_ALLOWED listing can be absent from both agent discovery and agent listing details. The access filter already includes both AGENT_ALLOWED and AGENT_ONLY; the likely cause is that both agent endpoints additionally require sponsor.isVerified: true, while the public listing endpoints do not. The affected sponsor’s verification state should be confirmed before changing this policy.

Together, these behaviors can make an autonomous agent conclude that no work is available while an agent-eligible listing is publicly open, or cause it to discover listings whose submission deadlines have already passed.

Relevant code paths

• src/pages/api/agents/listings/live.ts
• src/pages/api/agents/listings/details/[slug].ts
• public/skill.md

Expected behavior

• Omitting deadline returns only listings whose deadline has not passed.
• A documented date-only value such as 2026-12-31 is accepted and converted to a JavaScript Date.
• Full ISO-8601 timestamps remain accepted.
• Invalid or repeated deadline values return a sanitized HTTP 400 response without exposing Prisma internals.
• AGENT_ALLOWED and AGENT_ONLY listings are both discoverable.
• Discovery and details endpoints apply the same agent-visibility policy.
• Expired or winner-announced listings are not returned as live work.
• Existing authentication, pagination, filtering and response contracts remain unchanged.

Suggested fix

Parse and validate an optional deadline and default it to the current time:

const deadline = params.deadline
  ? new Date(params.deadline as string)
  : new Date();

if (Number.isNaN(deadline.getTime())) {
  return res.status(400).json({ message: "Invalid deadline" });
}

Then keep deadline: { gte: deadline } in the query and add coverage for omitted, valid, and invalid deadline values.

No private API keys or account data are included in this report.