@nextsparkjs/core 0.1.0-beta.185 → 0.1.0-beta.187

package/dist/templates/app/api/v1/media/[id]/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest } from 'next/server'
-import { authenticateRequest, hasRequiredScope, resolveTeamContext } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse, resolveTeamContext } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { createApiResponse, createApiError } from '@nextsparkjs/core/lib/api/helpers'
 import { API_ERROR_CODES } from '@nextsparkjs/core/lib/api/api-error'
 import { checkPermission } from '@nextsparkjs/core/lib/permissions/check'
@@ -20,15 +20,11 @@ export const GET = withRateLimitTier(async (
   { params }: { params: Promise<{ id: string }> }
 ) => {
   try {
-    // 1. Authenticate
-    const authResult = await authenticateRequest(request)
+    // 1. Authenticate; the API-key scope is declared at the entry point,
+    // which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'media:read' })
     if (!authResult.success) {
-      return createApiError('Unauthorized', 401)
-    }
-
-    // 2. Check permissions
-    if (!hasRequiredScope(authResult, 'media:read')) {
-      return createApiError('Insufficient permissions', 403, undefined, API_ERROR_CODES.INSUFFICIENT_SCOPE)
+      return createAuthFailureResponse(authResult)
     }
 
     // 3. Resolve and validate team context
@@ -76,15 +72,11 @@ export const PATCH = withRateLimitTier(async (
   { params }: { params: Promise<{ id: string }> }
 ) => {
   try {
-    // 1. Authenticate
-    const authResult = await authenticateRequest(request)
+    // 1. Authenticate; the API-key scope is declared at the entry point,
+    // which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'media:write' })
     if (!authResult.success) {
-      return createApiError('Unauthorized', 401)
-    }
-
-    // 2. Check permissions
-    if (!hasRequiredScope(authResult, 'media:write')) {
-      return createApiError('Insufficient permissions', 403, undefined, API_ERROR_CODES.INSUFFICIENT_SCOPE)
+      return createAuthFailureResponse(authResult)
     }
 
     // 3. Resolve and validate team context
@@ -141,15 +133,11 @@ export const DELETE = withRateLimitTier(async (
   { params }: { params: Promise<{ id: string }> }
 ) => {
   try {
-    // 1. Authenticate
-    const authResult = await authenticateRequest(request)
+    // 1. Authenticate; the API-key scope is declared at the entry point,
+    // which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'media:delete' })
     if (!authResult.success) {
-      return createApiError('Unauthorized', 401)
-    }
-
-    // 2. Check permissions
-    if (!hasRequiredScope(authResult, 'media:delete')) {
-      return createApiError('Insufficient permissions', 403, undefined, API_ERROR_CODES.INSUFFICIENT_SCOPE)
+      return createAuthFailureResponse(authResult)
     }
 
     // 3. Resolve and validate team context

package/dist/templates/app/api/v1/media/[id]/tags/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest } from 'next/server'
-import { authenticateRequest, hasRequiredScope, resolveTeamContext } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse, resolveTeamContext } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { createApiResponse, createApiError } from '@nextsparkjs/core/lib/api/helpers'
 import { API_ERROR_CODES } from '@nextsparkjs/core/lib/api/api-error'
 import { checkPermission } from '@nextsparkjs/core/lib/permissions/check'
@@ -25,13 +25,11 @@ export const GET = withRateLimitTier(async (
   { params }: { params: Promise<{ id: string }> }
 ) => {
   try {
-    const authResult = await authenticateRequest(request)
+    // Authenticate; the API-key scope is declared at the entry point, which
+    // fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'media:read' })
     if (!authResult.success) {
-      return createApiError('Unauthorized', 401)
-    }
-
-    if (!hasRequiredScope(authResult, 'media:read')) {
-      return createApiError('Insufficient permissions', 403, undefined, API_ERROR_CODES.INSUFFICIENT_SCOPE)
+      return createAuthFailureResponse(authResult)
     }
 
     const teamResult = await resolveTeamContext(request, authResult)
@@ -70,13 +68,11 @@ export const POST = withRateLimitTier(async (
   { params }: { params: Promise<{ id: string }> }
 ) => {
   try {
-    const authResult = await authenticateRequest(request)
+    // Authenticate; the API-key scope is declared at the entry point, which
+    // fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'media:write' })
     if (!authResult.success) {
-      return createApiError('Unauthorized', 401)
-    }
-
-    if (!hasRequiredScope(authResult, 'media:write')) {
-      return createApiError('Insufficient permissions', 403, undefined, API_ERROR_CODES.INSUFFICIENT_SCOPE)
+      return createAuthFailureResponse(authResult)
     }
 
     const teamResult = await resolveTeamContext(request, authResult)
@@ -124,13 +120,11 @@ export const PUT = withRateLimitTier(async (
   { params }: { params: Promise<{ id: string }> }
 ) => {
   try {
-    const authResult = await authenticateRequest(request)
+    // Authenticate; the API-key scope is declared at the entry point, which
+    // fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'media:write' })
     if (!authResult.success) {
-      return createApiError('Unauthorized', 401)
-    }
-
-    if (!hasRequiredScope(authResult, 'media:write')) {
-      return createApiError('Insufficient permissions', 403, undefined, API_ERROR_CODES.INSUFFICIENT_SCOPE)
+      return createAuthFailureResponse(authResult)
     }
 
     const teamResult = await resolveTeamContext(request, authResult)
@@ -178,13 +172,11 @@ export const DELETE = withRateLimitTier(async (
   { params }: { params: Promise<{ id: string }> }
 ) => {
   try {
-    const authResult = await authenticateRequest(request)
+    // Authenticate; the API-key scope is declared at the entry point, which
+    // fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'media:write' })
     if (!authResult.success) {
-      return createApiError('Unauthorized', 401)
-    }
-
-    if (!hasRequiredScope(authResult, 'media:write')) {
-      return createApiError('Insufficient permissions', 403, undefined, API_ERROR_CODES.INSUFFICIENT_SCOPE)
+      return createAuthFailureResponse(authResult)
     }
 
     const teamResult = await resolveTeamContext(request, authResult)

package/dist/templates/app/api/v1/media/check-duplicates/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest } from 'next/server'
-import { authenticateRequest, hasRequiredScope, resolveTeamContext } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse, resolveTeamContext } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { createApiResponse, createApiError } from '@nextsparkjs/core/lib/api/helpers'
 import { API_ERROR_CODES } from '@nextsparkjs/core/lib/api/api-error'
 import { checkPermission } from '@nextsparkjs/core/lib/permissions/check'
@@ -17,13 +17,11 @@ import { MediaService } from '@nextsparkjs/core/lib/services/media.service'
  */
 export const POST = withRateLimitTier(async (request: NextRequest) => {
   try {
-    const authResult = await authenticateRequest(request)
+    // Authenticate; the API-key scope is declared at the entry point, which
+    // fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'media:read' })
     if (!authResult.success) {
-      return createApiError('Unauthorized', 401)
-    }
-
-    if (!hasRequiredScope(authResult, 'media:read')) {
-      return createApiError('Insufficient permissions', 403, undefined, API_ERROR_CODES.INSUFFICIENT_SCOPE)
+      return createAuthFailureResponse(authResult)
     }
 
     const teamResult = await resolveTeamContext(request, authResult)

package/dist/templates/app/api/v1/media/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest } from 'next/server'
-import { authenticateRequest, hasRequiredScope, resolveTeamContext } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse, resolveTeamContext } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { createApiResponse, createApiError } from '@nextsparkjs/core/lib/api/helpers'
 import { API_ERROR_CODES } from '@nextsparkjs/core/lib/api/api-error'
 import { checkPermission } from '@nextsparkjs/core/lib/permissions/check'
@@ -26,15 +26,11 @@ import { mediaListQuerySchema } from '@nextsparkjs/core/lib/media/schemas'
  */
 export const GET = withRateLimitTier(async (request: NextRequest) => {
   try {
-    // 1. Authenticate
-    const authResult = await authenticateRequest(request)
+    // 1. Authenticate; the API-key scope is declared at the entry point,
+    // which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'media:read' })
     if (!authResult.success) {
-      return createApiError('Unauthorized', 401)
-    }
-
-    // 2. Check permissions
-    if (!hasRequiredScope(authResult, 'media:read')) {
-      return createApiError('Insufficient permissions', 403, undefined, API_ERROR_CODES.INSUFFICIENT_SCOPE)
+      return createAuthFailureResponse(authResult)
     }
 
     // 3. Resolve and validate team context

package/dist/templates/app/api/v1/media/upload/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest } from 'next/server'
 import { put } from '@vercel/blob'
-import { authenticateRequest, hasRequiredScope, resolveTeamContext } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse, resolveTeamContext } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { createApiResponse, createApiError } from '@nextsparkjs/core/lib/api/helpers'
 import { API_ERROR_CODES } from '@nextsparkjs/core/lib/api/api-error'
 import { checkPermission } from '@nextsparkjs/core/lib/permissions/check'
@@ -55,18 +55,12 @@ async function uploadToLocalStorageBuffer(buffer: Buffer, fileName: string): Pro
  */
 export const POST = withRateLimitTier(async (request: NextRequest) => {
   try {
-    // 1. Dual Authentication (API Key OR Session)
-    const authResult = await authenticateRequest(request)
+    // 1. Dual Authentication (API Key OR Session); the API-key scope is
+    // declared at the entry point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'media:write' })
 
     if (!authResult.success) {
-      return createApiError('Unauthorized', 401)
-    }
-
-    // 2. Check permissions for media upload
-    const hasPermission = hasRequiredScope(authResult, 'media:write')
-
-    if (!hasPermission) {
-      return createApiError('Insufficient permissions', 403, undefined, API_ERROR_CODES.INSUFFICIENT_SCOPE)
+      return createAuthFailureResponse(authResult)
     }
 
     // 3. Resolve and validate team context
@@ -237,18 +231,12 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
  */
 export const GET = withRateLimitTier(async (request: NextRequest) => {
   try {
-    // 1. Dual Authentication (API Key OR Session)
-    const authResult = await authenticateRequest(request)
+    // 1. Dual Authentication (API Key OR Session); the API-key scope is
+    // declared at the entry point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'media:read' })
 
     if (!authResult.success) {
-      return createApiError('Unauthorized', 401)
-    }
-
-    // 2. Check permissions for media read
-    const hasPermission = hasRequiredScope(authResult, 'media:read')
-
-    if (!hasPermission) {
-      return createApiError('Insufficient permissions', 403, undefined, API_ERROR_CODES.INSUFFICIENT_SCOPE)
+      return createAuthFailureResponse(authResult)
     }
 
     // 3. Resolve and validate team context

package/dist/templates/app/api/v1/media-tags/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest } from 'next/server'
-import { authenticateRequest, hasRequiredScope, resolveTeamContext } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse, resolveTeamContext } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { createApiResponse, createApiError } from '@nextsparkjs/core/lib/api/helpers'
 import { API_ERROR_CODES } from '@nextsparkjs/core/lib/api/api-error'
 import { checkPermission } from '@nextsparkjs/core/lib/permissions/check'
@@ -15,13 +15,11 @@ import { MediaService } from '@nextsparkjs/core/lib/services/media.service'
  */
 export const GET = withRateLimitTier(async (request: NextRequest) => {
   try {
-    const authResult = await authenticateRequest(request)
+    // Authenticate; the API-key scope is declared at the entry point, which
+    // fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'media:read' })
     if (!authResult.success) {
-      return createApiError('Unauthorized', 401)
-    }
-
-    if (!hasRequiredScope(authResult, 'media:read')) {
-      return createApiError('Insufficient permissions', 403, undefined, API_ERROR_CODES.INSUFFICIENT_SCOPE)
+      return createAuthFailureResponse(authResult)
     }
 
     const teamResult = await resolveTeamContext(request, authResult)
@@ -51,13 +49,11 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
  */
 export const POST = withRateLimitTier(async (request: NextRequest) => {
   try {
-    const authResult = await authenticateRequest(request)
+    // Authenticate; the API-key scope is declared at the entry point, which
+    // fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'media:write' })
     if (!authResult.success) {
-      return createApiError('Unauthorized', 401)
-    }
-
-    if (!hasRequiredScope(authResult, 'media:write')) {
-      return createApiError('Insufficient permissions', 403, undefined, API_ERROR_CODES.INSUFFICIENT_SCOPE)
+      return createAuthFailureResponse(authResult)
     }
 
     const teamResult = await resolveTeamContext(request, authResult)

package/dist/templates/app/api/v1/patterns/[id]/usages/route.ts

@@ -23,46 +23,38 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
-import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { PatternUsageService } from '@nextsparkjs/core/lib/services'
 import { queryOneWithRLS } from '@nextsparkjs/core/lib/db'
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request)
 }
 
 // GET /api/v1/patterns/:id/usages - Get pattern usages
 export const GET = withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ id: string }> }): Promise<NextResponse> => {
     try {
-      // Authenticate using dual auth
-      const authResult = await authenticateRequest(req)
+      // Authenticate using dual auth; the required API-key scope is declared
+      // at the entry point (fail closed, #93).
+      const authResult = await authenticateRequest(req, { requiredScope: 'patterns:read' })
 
       if (!authResult.success) {
-        return NextResponse.json(
-          { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-          { status: 401 }
-        )
+        return createAuthFailureResponse(authResult)
       }
 
       if (authResult.rateLimitResponse) {
         return authResult.rateLimitResponse as NextResponse
       }
 
-      // Check required permissions
-      if (!hasRequiredScope(authResult, 'patterns:read')) {
-        const response = createApiError('Insufficient permissions', 403)
-        return addCorsHeaders(response)
-      }
-
       const { id: patternId } = await params
       const userId = authResult.user!.id
 
       // Validate that patternId is not empty
       if (!patternId || patternId.trim() === '') {
         const response = createApiError('Pattern ID is required', 400, null, 'MISSING_PATTERN_ID')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Verify pattern exists and user has access
@@ -74,7 +66,7 @@ export const GET = withApiLogging(
 
       if (!pattern) {
         const response = createApiError('Pattern not found', 404, null, 'PATTERN_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Parse query parameters
@@ -106,11 +98,11 @@ export const GET = withApiLogging(
         entityType: entityType || 'all',
       })
 
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     } catch (error) {
       console.error('Error fetching pattern usages:', error)
       const response = createApiError('Internal server error', 500)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
   }
 )

package/dist/templates/app/api/v1/post-categories/[id]/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { query as dbQuery } from '@nextsparkjs/core/lib/db'
 import { z } from 'zod'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
@@ -52,10 +52,11 @@ export const PUT = withRateLimitTier(async (
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Dual authentication: API key or session
-    const authResult = await authenticateRequest(request)
+    // Dual authentication: API key or session; the API-key scope is declared
+    // at the entry point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'posts:write' })
     if (!authResult.success || !authResult.user) {
-      return NextResponse.json({ success: false, error: 'Unauthorized' }, { status: 401 })
+      return createAuthFailureResponse(authResult)
     }
 
     const body = await request.json()
@@ -192,10 +193,11 @@ export const DELETE = withRateLimitTier(async (
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Dual authentication: API key or session
-    const authResult = await authenticateRequest(request)
+    // Dual authentication: API key or session; the API-key scope is declared
+    // at the entry point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'posts:delete' })
     if (!authResult.success || !authResult.user) {
-      return NextResponse.json({ success: false, error: 'Unauthorized' }, { status: 401 })
+      return createAuthFailureResponse(authResult)
     }
 
     const { id } = await params

package/dist/templates/app/api/v1/post-categories/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { query as dbQuery } from '@nextsparkjs/core/lib/db'
 import { z } from 'zod'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
@@ -50,10 +50,11 @@ export const GET = withRateLimitTier(async () => {
 // POST /api/v1/post-categories - Create category
 export const POST = withRateLimitTier(async (request: NextRequest) => {
   try {
-    // Dual authentication: API key or session
-    const authResult = await authenticateRequest(request)
+    // Dual authentication: API key or session; the API-key scope is declared
+    // at the entry point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'posts:write' })
     if (!authResult.success || !authResult.user) {
-      return NextResponse.json({ success: false, error: 'Unauthorized' }, { status: 401 })
+      return createAuthFailureResponse(authResult)
     }
 
     const body = await request.json()

package/dist/templates/app/api/v1/team-invitations/[token]/accept/route.ts

@@ -7,28 +7,26 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { checkRateLimit, withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { RATE_LIMITS } from '@nextsparkjs/core/lib/api/keys'
 import type { TeamInvitation, TeamMember } from '@nextsparkjs/core/lib/teams/types'
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request)
 }
 
 // POST /api/v1/team-invitations/:token/accept - Accept invitation and become member
 export const POST = withRateLimitTier(withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ token: string }> }): Promise<NextResponse> => {
     try {
-      // Authenticate using dual auth
-      const authResult = await authenticateRequest(req)
+      // Authenticate using dual auth; the API-key scope is declared at the entry
+      // point, which fails closed for keys that lack it (#93).
+      const authResult = await authenticateRequest(req, { requiredScope: 'teams:write' })
 
       if (!authResult.success) {
-        return NextResponse.json(
-          { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-          { status: 401 }
-        )
+        return createAuthFailureResponse(authResult)
       }
 
       if (authResult.rateLimitResponse) {
@@ -47,7 +45,7 @@ export const POST = withRateLimitTier(withApiLogging(
           { retryAfter: Math.ceil((rateLimit.resetTime - Date.now()) / 1000) },
           'RATE_LIMIT_EXCEEDED'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       const { token } = await params
@@ -55,7 +53,7 @@ export const POST = withRateLimitTier(withApiLogging(
       // Validate that token is not empty
       if (!token || token.trim() === '') {
         const response = createApiError('Invitation token is required', 400, null, 'MISSING_TOKEN')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Get invitation by token
@@ -67,7 +65,7 @@ export const POST = withRateLimitTier(withApiLogging(
 
       if (!invitation) {
         const response = createApiError('Invitation not found', 404, null, 'INVITATION_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Verify invitation is for the current user's email
@@ -78,7 +76,7 @@ export const POST = withRateLimitTier(withApiLogging(
           null,
           'EMAIL_MISMATCH'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if invitation is pending
@@ -89,7 +87,7 @@ export const POST = withRateLimitTier(withApiLogging(
           null,
           'INVITATION_NOT_PENDING'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if invitation has expired
@@ -103,7 +101,7 @@ export const POST = withRateLimitTier(withApiLogging(
         )
 
         const response = createApiError('Invitation has expired', 410, null, 'INVITATION_EXPIRED')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if user is already a member
@@ -115,7 +113,7 @@ export const POST = withRateLimitTier(withApiLogging(
 
       if (existingMember) {
         const response = createApiError('You are already a member of this team', 409, null, 'ALREADY_MEMBER')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Use transaction to ensure atomicity
@@ -165,7 +163,7 @@ export const POST = withRateLimitTier(withApiLogging(
         )
 
         const response = createApiResponse(memberWithUser, { created: true }, 201)
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       } catch (error) {
         await tx.rollback()
         throw error
@@ -173,7 +171,7 @@ export const POST = withRateLimitTier(withApiLogging(
     } catch (error) {
       console.error('Error accepting invitation:', error)
       const response = createApiError('Internal server error', 500)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
   }
 ), 'write');

package/dist/templates/app/api/v1/team-invitations/[token]/decline/route.ts

@@ -7,28 +7,26 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { checkRateLimit, withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { RATE_LIMITS } from '@nextsparkjs/core/lib/api/keys'
 import type { TeamInvitation } from '@nextsparkjs/core/lib/teams/types'
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request)
 }
 
 // POST /api/v1/team-invitations/:token/decline - Decline invitation
 export const POST = withRateLimitTier(withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ token: string }> }): Promise<NextResponse> => {
     try {
-      // Authenticate using dual auth
-      const authResult = await authenticateRequest(req)
+      // Authenticate using dual auth; the API-key scope is declared at the entry
+      // point, which fails closed for keys that lack it (#93).
+      const authResult = await authenticateRequest(req, { requiredScope: 'teams:write' })
 
       if (!authResult.success) {
-        return NextResponse.json(
-          { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-          { status: 401 }
-        )
+        return createAuthFailureResponse(authResult)
       }
 
       if (authResult.rateLimitResponse) {
@@ -47,7 +45,7 @@ export const POST = withRateLimitTier(withApiLogging(
           { retryAfter: Math.ceil((rateLimit.resetTime - Date.now()) / 1000) },
           'RATE_LIMIT_EXCEEDED'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       const { token } = await params
@@ -55,7 +53,7 @@ export const POST = withRateLimitTier(withApiLogging(
       // Validate that token is not empty
       if (!token || token.trim() === '') {
         const response = createApiError('Invitation token is required', 400, null, 'MISSING_TOKEN')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Get invitation by token
@@ -67,7 +65,7 @@ export const POST = withRateLimitTier(withApiLogging(
 
       if (!invitation) {
         const response = createApiError('Invitation not found', 404, null, 'INVITATION_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Verify invitation is for the current user's email
@@ -78,7 +76,7 @@ export const POST = withRateLimitTier(withApiLogging(
           null,
           'EMAIL_MISMATCH'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if invitation is pending
@@ -89,7 +87,7 @@ export const POST = withRateLimitTier(withApiLogging(
           null,
           'INVITATION_NOT_PENDING'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Update invitation status to declined
@@ -104,17 +102,17 @@ export const POST = withRateLimitTier(withApiLogging(
 
       if (result.rows.length === 0) {
         const response = createApiError('Invitation not found', 404, null, 'INVITATION_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       const declinedInvitation = result.rows[0]
 
       const response = createApiResponse(declinedInvitation)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     } catch (error) {
       console.error('Error declining invitation:', error)
       const response = createApiError('Internal server error', 500)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
   }
 ), 'write');