Mattsson
16164ea14c
* feat(voucher): add create voucher and correct entry previews; update commit methods * feat: add support for pending operations in API key scopes and OAuth client management - Introduced new API key scopes for reading and approving pending operations. - Updated the scope groups to include pending operations. - Added new tools for listing and managing pending operations. - Implemented OAuth client registration and revocation endpoints. - Created a UI panel for managing OAuth clients, including registration and revocation. - Added tests for pending operations tools and OAuth allowlist functionality. - Implemented a database migration for OAuth client registrations with appropriate policies and constraints. * feat: Implement OAuth client registration rate limiting and enhance security measures - Added IP-based rate limiting to the OAuth client registration endpoint to prevent enumeration attacks. - Introduced a service-role client for allowlist lookups, ensuring trust boundaries are maintained. - Updated error responses to be uniform across different types of redirect URI validation failures. - Enhanced tests to reflect changes in OAuth scope handling, ensuring fallback to read-only scopes when no scopes are provided. - Improved handling of high-risk pending operations, requiring explicit confirmation for approvals. - Added audit logging for OAuth client revocations and pending operation approvals/rejections to maintain a security audit trail. - Refactored API key scope management to include default read-only scopes for OAuth-issued keys and added segregation-of-duties checks.
62 lines
1.8 KiB
TypeScript
62 lines
1.8 KiB
TypeScript
import { createClient } from '@/lib/supabase/server'
|
|
import { NextResponse } from 'next/server'
|
|
import { ensureInitialized } from '@/lib/init'
|
|
import { requireCompanyId } from '@/lib/company/context'
|
|
import { requireWritePermission } from '@/lib/auth/require-write'
|
|
import { commitPendingOperation } from '@/lib/pending-operations/commit'
|
|
import { bookkeepingErrorResponse } from '@/lib/bookkeeping/errors'
|
|
import type { PendingOperation } from '@/types'
|
|
|
|
ensureInitialized()
|
|
|
|
export async function POST(
|
|
_request: Request,
|
|
{ params }: { params: Promise<{ id: string }> }
|
|
) {
|
|
const supabase = await createClient()
|
|
const { id } = await params
|
|
|
|
const { data: { user } } = await supabase.auth.getUser()
|
|
if (!user) {
|
|
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
|
}
|
|
|
|
const writeCheck = await requireWritePermission(supabase, user.id)
|
|
if (!writeCheck.ok) return writeCheck.response
|
|
|
|
const companyId = await requireCompanyId(supabase, user.id)
|
|
|
|
const { data: op, error: fetchError } = await supabase
|
|
.from('pending_operations')
|
|
.select('*')
|
|
.eq('id', id)
|
|
.eq('company_id', companyId)
|
|
.single()
|
|
|
|
if (fetchError || !op) {
|
|
return NextResponse.json({ error: 'Pending operation not found' }, { status: 404 })
|
|
}
|
|
|
|
try {
|
|
const result = await commitPendingOperation(
|
|
supabase,
|
|
user.id,
|
|
companyId,
|
|
op as PendingOperation,
|
|
{ userEmail: user.email, commitMethod: 'user_accept' }
|
|
)
|
|
|
|
if (result.status === 'committed') {
|
|
return NextResponse.json({ data: result.data })
|
|
}
|
|
return NextResponse.json(
|
|
{ error: result.error },
|
|
{ status: result.http_status ?? 500 }
|
|
)
|
|
} catch (err) {
|
|
const typed = bookkeepingErrorResponse(err)
|
|
if (typed) return typed
|
|
throw err
|
|
}
|
|
}
|