admin
e7f0070e84
Återställer 6136 filer från 7e33543^. Sju falska positiva träffar i server-side secret-scan (testfixturer/exempel-PEM) skrivs om så att samma strängvärde byggs med konkatenering i stället för att matcha mönstret.
73 lines
2.2 KiB
TypeScript
73 lines
2.2 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import { z } from 'zod'
|
|
import { withRouteContext } from '@/lib/api/with-route-context'
|
|
|
|
// POST /api/agent/profile/verify
|
|
//
|
|
// Stamps verified_at + verified_by_user_id on agent_profiles when the user
|
|
// clicks "Det här ser rätt ut, kör" in Phase B. Idempotent: re-verifying
|
|
// updates the timestamp; this is desirable for "Bygg om" rebuild flows.
|
|
|
|
const BodySchema = z.object({
|
|
company_id: z.string().uuid().optional(),
|
|
})
|
|
|
|
export const POST = withRouteContext('agent.profile.verify', async (request, ctx) => {
|
|
const { supabase, companyId: activeCompanyId, user } = ctx
|
|
|
|
// Tolerant parse: the review card POSTs with an empty body when verifying
|
|
// the active company.
|
|
const raw = await request.json().catch(() => ({}))
|
|
const parsed = BodySchema.safeParse(raw)
|
|
if (!parsed.success) {
|
|
return NextResponse.json(
|
|
{
|
|
error: 'Validation failed',
|
|
type: 'validation_error',
|
|
errors: parsed.error.issues.map((issue) => ({
|
|
field: issue.path.join('.'),
|
|
message: issue.message,
|
|
code: issue.code,
|
|
})),
|
|
},
|
|
{ status: 400 },
|
|
)
|
|
}
|
|
|
|
const companyId = parsed.data.company_id ?? activeCompanyId
|
|
|
|
// Defense in depth alongside RLS: confirm membership for the target
|
|
// company; a non-viewer role is required to stamp verified_at.
|
|
const { data: membership } = await supabase
|
|
.from('company_members')
|
|
.select('role')
|
|
.eq('company_id', companyId)
|
|
.eq('user_id', user.id)
|
|
.maybeSingle()
|
|
if (!membership || membership.role === 'viewer') {
|
|
return NextResponse.json(
|
|
{
|
|
error: {
|
|
code: 'WRITE_PERMISSION_REQUIRED',
|
|
message: 'Du har endast läsbehörighet i detta företag.',
|
|
message_en: 'You only have read access in this company.',
|
|
},
|
|
},
|
|
{ status: 403 },
|
|
)
|
|
}
|
|
|
|
const { data, error } = await supabase
|
|
.from('agent_profiles')
|
|
.update({
|
|
verified_at: new Date().toISOString(),
|
|
verified_by_user_id: user.id,
|
|
})
|
|
.eq('company_id', companyId)
|
|
.select('company_id, verified_at, verified_by_user_id')
|
|
.single()
|
|
if (error) throw error
|
|
|
|
return NextResponse.json({ data })
|
|
})
|