letsbe/pn-new-crm
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(audit): rate-limit/DoS — M13 (bulk limiter on 6 routes), M14 (api limiter default in withAuth, fail-open), M15 (export-pdf payload bounds); L21 verified not-a-bug

Browse Source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Matt
2026-06-02 13:07:25 +02:00
parent ebe5fe6ed8
commit 64c73a5d77
8 changed files with 518 additions and 457 deletions
Download Patch File Download Diff File Expand all files Collapse all files

82
src/app/api/v1/yachts/bulk/route.ts
View File

@@ -2,7 +2,7 @@ import { NextResponse } from 'next/server';
import { z } from 'zod';
import { eq, and } from 'drizzle-orm';
import { withAuth } from '@/lib/api/helpers';
import { withAuth, withRateLimit } from '@/lib/api/helpers';
import { parseBody } from '@/lib/api/route-helpers';
import { runBulk } from '@/lib/api/bulk-helpers';
import { db } from '@/lib/db';
@@ -33,44 +33,46 @@ const PERMISSION_BY_ACTION = {
remove_tag: 'edit' as const,
};
export const POST = withAuth(async (req, ctx) => {
let body: z.infer<typeof bulkSchema>;
try {
body = await parseBody(req, bulkSchema);
} catch (error) {
return errorResponse(error);
}
const allowed = ctx.isSuperAdmin
? true
: !!ctx.permissions?.yachts?.[PERMISSION_BY_ACTION[body.action]];
if (!allowed) return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
const meta = {
userId: ctx.userId,
portId: ctx.portId,
ipAddress: ctx.ipAddress,
userAgent: ctx.userAgent,
};
const { results, summary } = await runBulk(body.ids, async (id) => {
if (body.action === 'archive') {
await archiveYacht(id, ctx.portId, meta);
return;
export const POST = withAuth(
withRateLimit('bulk', async (req, ctx) => {
let body: z.infer<typeof bulkSchema>;
try {
body = await parseBody(req, bulkSchema);
} catch (error) {
return errorResponse(error);
}
const yacht = await db.query.yachts.findFirst({
where: and(eq(yachts.id, id), eq(yachts.portId, ctx.portId)),
});
if (!yacht) throw new Error('Yacht not found');
const existing = await db
.select({ tagId: yachtTags.tagId })
.from(yachtTags)
.where(eq(yachtTags.yachtId, id));
const current = new Set(existing.map((t) => t.tagId));
if (body.action === 'add_tag') current.add(body.tagId);
else current.delete(body.tagId);
await setYachtTags(id, ctx.portId, Array.from(current), meta);
});
return NextResponse.json({ data: { results, summary } });
});
const allowed = ctx.isSuperAdmin
? true
: !!ctx.permissions?.yachts?.[PERMISSION_BY_ACTION[body.action]];
if (!allowed) return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
const meta = {
userId: ctx.userId,
portId: ctx.portId,
ipAddress: ctx.ipAddress,
userAgent: ctx.userAgent,
};
const { results, summary } = await runBulk(body.ids, async (id) => {
if (body.action === 'archive') {
await archiveYacht(id, ctx.portId, meta);
return;
}
const yacht = await db.query.yachts.findFirst({
where: and(eq(yachts.id, id), eq(yachts.portId, ctx.portId)),
});
if (!yacht) throw new Error('Yacht not found');
const existing = await db
.select({ tagId: yachtTags.tagId })
.from(yachtTags)
.where(eq(yachtTags.yachtId, id));
const current = new Set(existing.map((t) => t.tagId));
if (body.action === 'add_tag') current.add(body.tagId);
else current.delete(body.tagId);
await setYachtTags(id, ctx.portId, Array.from(current), meta);
});
return NextResponse.json({ data: { results, summary } });
}),
);