admin
e7f0070e84
Återställer 6136 filer från 7e33543^. Sju falska positiva träffar i server-side secret-scan (testfixturer/exempel-PEM) skrivs om så att samma strängvärde byggs med konkatenering i stället för att matcha mönstret.
61 lines
2.1 KiB
TypeScript
61 lines
2.1 KiB
TypeScript
import type { SupabaseClient } from '@supabase/supabase-js'
|
|
import { NextResponse } from 'next/server'
|
|
|
|
/**
|
|
* Sandbox guard: returns true if the given company is a sandbox company
|
|
* (`company_settings.is_sandbox = true`). Used to short-circuit API routes
|
|
* that would otherwise call paid external services (Anthropic Bedrock, the
|
|
* Resend email API, Riksbanken FX, VIES, Skatteverket, Enable Banking, TIC).
|
|
*
|
|
* The sandbox is intentionally read-only against external systems: it must
|
|
* never send a real email, charge a token, or speak to a tax authority on
|
|
* behalf of an anonymous demo user. RLS and the `is_sandbox` flag on
|
|
* company_settings are the single source of truth: we check it here on
|
|
* every gated entry point so the demo can't accidentally outgrow its sandbox.
|
|
*/
|
|
export async function isSandboxCompany(
|
|
supabase: SupabaseClient,
|
|
companyId: string,
|
|
): Promise<boolean> {
|
|
const { data } = await supabase
|
|
.from('company_settings')
|
|
.select('is_sandbox')
|
|
.eq('company_id', companyId)
|
|
.maybeSingle()
|
|
return data?.is_sandbox === true
|
|
}
|
|
|
|
/**
|
|
* Standard 403 response for sandbox-blocked endpoints. The bilingual envelope
|
|
* matches the rest of the app's error shape: the UI picks the right field
|
|
* via the active locale.
|
|
*/
|
|
export function sandboxBlockedResponse(): NextResponse {
|
|
return NextResponse.json(
|
|
{
|
|
error: 'Inte tillgängligt i sandlådan. Skapa ett konto för att använda AI-assistenten och externa tjänster.',
|
|
error_en: 'Not available in the sandbox. Create an account to use the AI assistant and external services.',
|
|
sandbox_blocked: true,
|
|
},
|
|
{ status: 403 },
|
|
)
|
|
}
|
|
|
|
/**
|
|
* Convenience wrapper: check + return the 403 in one call. Returns the
|
|
* NextResponse to return from the route, or `null` when the company is not
|
|
* a sandbox and the route should proceed.
|
|
*
|
|
* const blocked = await guardSandbox(supabase, companyId)
|
|
* if (blocked) return blocked
|
|
*/
|
|
export async function guardSandbox(
|
|
supabase: SupabaseClient,
|
|
companyId: string,
|
|
): Promise<NextResponse | null> {
|
|
if (await isSandboxCompany(supabase, companyId)) {
|
|
return sandboxBlockedResponse()
|
|
}
|
|
return null
|
|
}
|