a84373642e
Closes P0 #5 (CORS) from PARTIAL → RESOLVED. fix-auth-bypass
Brief 4 (commit 297afca) cleaned login + register; this brief
sweeps the remaining 24 pages/api/** handlers that carried the
identical scaffolded wildcard-CORS + redundant-OPTIONS pattern,
plus adds a blocking forbidden-cors-headers CI job to lock in
the cleanup against future regression.
Per architect Decision 1 — Option B (sweep all 24 in one PR)
chosen over Option A (narrow verify.js-only + queue separate
sweep). Pattern-drift audit (14 of 24 files spot-checked across
parent + architect) found zero drift; mechanical safety
confirmed.
Per Decision 2 — OPTIONS handler deleted entirely (matches
Brief 4 precedent). Same-origin Vercel deployment doesn't
preflight; method check at top of handler returns 405 if any
client ever sends OPTIONS again.
Per Decision 3 — verify.js's overly-permissive Allow-Methods:
'GET, POST, PUT, DELETE, OPTIONS' is moot (deleted under D2);
the handler's existing `if (req.method !== 'GET') return 405`
guard at line 17 (now line ~5) is the remaining gate.
Per Decision 4 — no new per-route tests this convoy. None of
the 24 routes have vitest coverage today; adding handler-level
tests is the queued fill-vitest-handler-coverage convoy.
Per Decision 5 — new `forbidden-cors-headers` CI job added,
modeled verbatim on `forbidden-endpoints`. Blocking (no
`|| true`, no `continue-on-error`). Greps pages/api/ for any
`Access-Control-Allow-(Origin|Methods|Headers)` reappearance
and exits 1 on hit.
Verification:
- npm run lint: 128 problems (baseline match)
- npm run test:run: 21/21 vitest pass (no regression)
- git grep -nE "Access-Control-Allow-..." -- 'pages/api/**':
zero matches
- git grep -nE "OPTIONS" -- 'pages/api/**': zero matches
(post-sweep)
- new forbidden-cors-headers grep exits 0 against swept tree
No code paths in lib/**, components/**, scripts/**, or test/**
touched. No package.json / lockfile churn. No workflow YAML
beyond the single ci.yml job addition. No AGENTS.md edits
(doc-writer pass at convoy close).
Co-authored-by: Cursor <cursoragent@cursor.com>
74 lines
2.2 KiB
JavaScript
74 lines
2.2 KiB
JavaScript
import { sql } from '@vercel/postgres';
|
|
|
|
export default async function handler(req, res) {
|
|
if (req.method !== 'POST') {
|
|
return res.status(405).json({ error: 'Method not allowed' });
|
|
}
|
|
|
|
try {
|
|
const { token } = req.body;
|
|
|
|
if (!token) {
|
|
return res.status(400).json({ error: 'Invitation token is required' });
|
|
}
|
|
|
|
// Find the invitation
|
|
const invitationResult = await sql`
|
|
SELECT cp.*, c.name as collection_name, u.email
|
|
FROM collection_permissions cp
|
|
JOIN collections c ON cp.collection_id = c.id
|
|
JOIN users u ON cp.user_id = u.id
|
|
WHERE cp.invite_token = ${token} AND cp.status = 'pending'
|
|
`;
|
|
|
|
if (invitationResult.rows.length === 0) {
|
|
return res.status(404).json({ error: 'Invalid or expired invitation' });
|
|
}
|
|
|
|
const invitation = invitationResult.rows[0];
|
|
|
|
// Check if invitation is expired (7 days)
|
|
const inviteDate = new Date(invitation.created_at);
|
|
const expiryDate = new Date(inviteDate.getTime() + 7 * 24 * 60 * 60 * 1000);
|
|
|
|
if (new Date() > expiryDate) {
|
|
return res.status(410).json({ error: 'Invitation has expired' });
|
|
}
|
|
|
|
// Accept the invitation
|
|
const result = await sql`
|
|
UPDATE collection_permissions
|
|
SET status = 'active', invite_token = NULL, updated_at = NOW()
|
|
WHERE invite_token = ${token}
|
|
RETURNING *
|
|
`;
|
|
|
|
// If user was pending, activate them
|
|
if (invitation.email) {
|
|
await sql`
|
|
UPDATE users
|
|
SET is_pending = false
|
|
WHERE id = ${invitation.user_id} AND is_pending = true
|
|
`;
|
|
}
|
|
|
|
// Log activity
|
|
await sql`
|
|
INSERT INTO collection_activity (collection_id, user_id, action, details)
|
|
VALUES (${invitation.collection_id}, ${invitation.user_id}, 'invitation_accepted', ${JSON.stringify({ token })})
|
|
`;
|
|
|
|
res.status(200).json({
|
|
message: 'Invitation accepted successfully',
|
|
collection: {
|
|
id: invitation.collection_id,
|
|
name: invitation.collection_name
|
|
},
|
|
permission: result.rows[0]
|
|
});
|
|
|
|
} catch (error) {
|
|
console.error('Error accepting invitation:', error);
|
|
res.status(500).json({ error: 'Internal server error' });
|
|
}
|
|
}
|