da50d78406
Closes P0 #5 from PARTIAL to RESOLVED. Sweeps the remaining 24 pages/api/** handlers that carried the identical scaffolded wildcard-CORS + OPTIONS preflight pattern (Brief 4 cleaned login + register; this finishes the job). Adds a blocking forbidden-cors-headers CI job modeled on forbidden-endpoints to lock the cleanup against future regression. 25 files changed (+29/-261). Local: lint 128 baseline, vitest 21/21, zero CORS matches, YAML valid. CI: Playwright smoke 3/3 in 3.3s against post-removal preview (login/verify flow still works), new forbidden-cors-headers job passes in 4s, all gates green. PR #19 architect-commitec22b70, implementer-commita843736.
45 lines
No EOL
1.2 KiB
JavaScript
45 lines
No EOL
1.2 KiB
JavaScript
import { sql } from '@vercel/postgres';
|
|
import jwt from 'jsonwebtoken';
|
|
import { JWT_SECRET } from '../../../lib/auth-secret.js';
|
|
|
|
export default async function handler(req, res) {
|
|
if (req.method !== 'GET') {
|
|
return res.status(405).json({ error: 'Method not allowed' });
|
|
}
|
|
|
|
try {
|
|
const authHeader = req.headers.authorization;
|
|
|
|
if (!authHeader || !authHeader.startsWith('Bearer ')) {
|
|
return res.status(401).json({ error: 'Authentication required' });
|
|
}
|
|
|
|
const token = authHeader.substring(7);
|
|
|
|
try {
|
|
const decoded = jwt.verify(token, JWT_SECRET);
|
|
|
|
// Get user data from database
|
|
const result = await sql`
|
|
SELECT id, email, role, created_at
|
|
FROM users
|
|
WHERE id = ${decoded.userId}
|
|
`;
|
|
|
|
if (result.rows.length === 0) {
|
|
return res.status(401).json({ error: 'User not found' });
|
|
}
|
|
|
|
const user = result.rows[0];
|
|
res.status(200).json(user);
|
|
|
|
} catch (jwtError) {
|
|
console.error('JWT verification error:', jwtError);
|
|
return res.status(401).json({ error: 'Invalid token' });
|
|
}
|
|
|
|
} catch (error) {
|
|
console.error('Auth verification error:', error);
|
|
res.status(500).json({ error: 'Internal server error' });
|
|
}
|
|
}
|