Mattsson
16164ea14c
* feat(voucher): add create voucher and correct entry previews; update commit methods * feat: add support for pending operations in API key scopes and OAuth client management - Introduced new API key scopes for reading and approving pending operations. - Updated the scope groups to include pending operations. - Added new tools for listing and managing pending operations. - Implemented OAuth client registration and revocation endpoints. - Created a UI panel for managing OAuth clients, including registration and revocation. - Added tests for pending operations tools and OAuth allowlist functionality. - Implemented a database migration for OAuth client registrations with appropriate policies and constraints. * feat: Implement OAuth client registration rate limiting and enhance security measures - Added IP-based rate limiting to the OAuth client registration endpoint to prevent enumeration attacks. - Introduced a service-role client for allowlist lookups, ensuring trust boundaries are maintained. - Updated error responses to be uniform across different types of redirect URI validation failures. - Enhanced tests to reflect changes in OAuth scope handling, ensuring fallback to read-only scopes when no scopes are provided. - Improved handling of high-risk pending operations, requiring explicit confirmation for approvals. - Added audit logging for OAuth client revocations and pending operation approvals/rejections to maintain a security audit trail. - Refactored API key scope management to include default read-only scopes for OAuth-issued keys and added segregation-of-duties checks.
91 lines
2.9 KiB
TypeScript
91 lines
2.9 KiB
TypeScript
import { createClient } from '@/lib/supabase/server'
|
|
import { NextResponse } from 'next/server'
|
|
import { ensureInitialized } from '@/lib/init'
|
|
import { requireCompanyId } from '@/lib/company/context'
|
|
import { requireWritePermission } from '@/lib/auth/require-write'
|
|
import { validateBody } from '@/lib/api/validate'
|
|
import { PendingOperationsBulkSchema } from '@/lib/api/schemas'
|
|
import { commitPendingOperation } from '@/lib/pending-operations/commit'
|
|
import type { PendingOperation } from '@/types'
|
|
|
|
ensureInitialized()
|
|
|
|
interface BulkCommitItemResult {
|
|
id: string
|
|
status: 'committed' | 'failed' | 'skipped' | 'rejected'
|
|
error?: string
|
|
}
|
|
|
|
export async function POST(request: Request) {
|
|
const supabase = await createClient()
|
|
|
|
const { data: { user } } = await supabase.auth.getUser()
|
|
if (!user) {
|
|
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
|
}
|
|
|
|
const writeCheck = await requireWritePermission(supabase, user.id)
|
|
if (!writeCheck.ok) return writeCheck.response
|
|
|
|
const validated = await validateBody(request, PendingOperationsBulkSchema)
|
|
if (!validated.success) return validated.response
|
|
const { ids } = validated.data
|
|
|
|
const companyId = await requireCompanyId(supabase, user.id)
|
|
|
|
const { data: ops, error: fetchError } = await supabase
|
|
.from('pending_operations')
|
|
.select('*')
|
|
.in('id', ids)
|
|
.eq('company_id', companyId)
|
|
|
|
if (fetchError) {
|
|
return NextResponse.json({ error: fetchError.message }, { status: 500 })
|
|
}
|
|
|
|
const opsById = new Map((ops ?? []).map((op) => [op.id, op as PendingOperation]))
|
|
const results: BulkCommitItemResult[] = []
|
|
|
|
for (const id of ids) {
|
|
const op = opsById.get(id)
|
|
if (!op) {
|
|
results.push({ id, status: 'failed', error: 'Operation not found' })
|
|
continue
|
|
}
|
|
if (op.status !== 'pending') {
|
|
results.push({ id, status: 'skipped', error: `Already ${op.status}` })
|
|
continue
|
|
}
|
|
if (op.risk_level === 'high') {
|
|
results.push({
|
|
id,
|
|
status: 'skipped',
|
|
error: 'Hög risk — kräver individuellt godkännande',
|
|
})
|
|
continue
|
|
}
|
|
|
|
const result = await commitPendingOperation(supabase, user.id, companyId, op, {
|
|
userEmail: user.email,
|
|
commitMethod: 'bulk_accept',
|
|
})
|
|
if (result.status === 'committed') {
|
|
results.push({ id, status: 'committed' })
|
|
} else if (result.status === 'rejected' && result.auto_rejected) {
|
|
results.push({ id, status: 'rejected', error: result.error ?? 'Avvisad' })
|
|
} else {
|
|
results.push({ id, status: 'failed', error: result.error ?? 'Misslyckades' })
|
|
}
|
|
}
|
|
|
|
const summary = {
|
|
total: results.length,
|
|
committed: results.filter((r) => r.status === 'committed').length,
|
|
failed: results.filter((r) => r.status === 'failed').length,
|
|
skipped: results.filter((r) => r.status === 'skipped').length,
|
|
rejected: results.filter((r) => r.status === 'rejected').length,
|
|
}
|
|
|
|
return NextResponse.json({ data: { results, summary } })
|
|
}
|