@nextsparkjs/core 0.1.0-beta.185 → 0.1.0-beta.187

package/templates/app/api/v1/post-categories/[id]/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { query as dbQuery } from '@nextsparkjs/core/lib/db'
 import { z } from 'zod'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
@@ -52,10 +52,11 @@ export const PUT = withRateLimitTier(async (
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Dual authentication: API key or session
-    const authResult = await authenticateRequest(request)
+    // Dual authentication: API key or session; the API-key scope is declared
+    // at the entry point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'posts:write' })
     if (!authResult.success || !authResult.user) {
-      return NextResponse.json({ success: false, error: 'Unauthorized' }, { status: 401 })
+      return createAuthFailureResponse(authResult)
     }
 
     const body = await request.json()
@@ -192,10 +193,11 @@ export const DELETE = withRateLimitTier(async (
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Dual authentication: API key or session
-    const authResult = await authenticateRequest(request)
+    // Dual authentication: API key or session; the API-key scope is declared
+    // at the entry point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'posts:delete' })
     if (!authResult.success || !authResult.user) {
-      return NextResponse.json({ success: false, error: 'Unauthorized' }, { status: 401 })
+      return createAuthFailureResponse(authResult)
     }
 
     const { id } = await params

package/templates/app/api/v1/post-categories/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { query as dbQuery } from '@nextsparkjs/core/lib/db'
 import { z } from 'zod'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
@@ -50,10 +50,11 @@ export const GET = withRateLimitTier(async () => {
 // POST /api/v1/post-categories - Create category
 export const POST = withRateLimitTier(async (request: NextRequest) => {
   try {
-    // Dual authentication: API key or session
-    const authResult = await authenticateRequest(request)
+    // Dual authentication: API key or session; the API-key scope is declared
+    // at the entry point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(request, { requiredScope: 'posts:write' })
     if (!authResult.success || !authResult.user) {
-      return NextResponse.json({ success: false, error: 'Unauthorized' }, { status: 401 })
+      return createAuthFailureResponse(authResult)
     }
 
     const body = await request.json()

package/templates/app/api/v1/team-invitations/[token]/accept/route.ts

@@ -7,28 +7,26 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { checkRateLimit, withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { RATE_LIMITS } from '@nextsparkjs/core/lib/api/keys'
 import type { TeamInvitation, TeamMember } from '@nextsparkjs/core/lib/teams/types'
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request)
 }
 
 // POST /api/v1/team-invitations/:token/accept - Accept invitation and become member
 export const POST = withRateLimitTier(withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ token: string }> }): Promise<NextResponse> => {
     try {
-      // Authenticate using dual auth
-      const authResult = await authenticateRequest(req)
+      // Authenticate using dual auth; the API-key scope is declared at the entry
+      // point, which fails closed for keys that lack it (#93).
+      const authResult = await authenticateRequest(req, { requiredScope: 'teams:write' })
 
       if (!authResult.success) {
-        return NextResponse.json(
-          { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-          { status: 401 }
-        )
+        return createAuthFailureResponse(authResult)
       }
 
       if (authResult.rateLimitResponse) {
@@ -47,7 +45,7 @@ export const POST = withRateLimitTier(withApiLogging(
           { retryAfter: Math.ceil((rateLimit.resetTime - Date.now()) / 1000) },
           'RATE_LIMIT_EXCEEDED'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       const { token } = await params
@@ -55,7 +53,7 @@ export const POST = withRateLimitTier(withApiLogging(
       // Validate that token is not empty
       if (!token || token.trim() === '') {
         const response = createApiError('Invitation token is required', 400, null, 'MISSING_TOKEN')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Get invitation by token
@@ -67,7 +65,7 @@ export const POST = withRateLimitTier(withApiLogging(
 
       if (!invitation) {
         const response = createApiError('Invitation not found', 404, null, 'INVITATION_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Verify invitation is for the current user's email
@@ -78,7 +76,7 @@ export const POST = withRateLimitTier(withApiLogging(
           null,
           'EMAIL_MISMATCH'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if invitation is pending
@@ -89,7 +87,7 @@ export const POST = withRateLimitTier(withApiLogging(
           null,
           'INVITATION_NOT_PENDING'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if invitation has expired
@@ -103,7 +101,7 @@ export const POST = withRateLimitTier(withApiLogging(
         )
 
         const response = createApiError('Invitation has expired', 410, null, 'INVITATION_EXPIRED')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if user is already a member
@@ -115,7 +113,7 @@ export const POST = withRateLimitTier(withApiLogging(
 
       if (existingMember) {
         const response = createApiError('You are already a member of this team', 409, null, 'ALREADY_MEMBER')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Use transaction to ensure atomicity
@@ -165,7 +163,7 @@ export const POST = withRateLimitTier(withApiLogging(
         )
 
         const response = createApiResponse(memberWithUser, { created: true }, 201)
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       } catch (error) {
         await tx.rollback()
         throw error
@@ -173,7 +171,7 @@ export const POST = withRateLimitTier(withApiLogging(
     } catch (error) {
       console.error('Error accepting invitation:', error)
       const response = createApiError('Internal server error', 500)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
   }
 ), 'write');

package/templates/app/api/v1/team-invitations/[token]/decline/route.ts

@@ -7,28 +7,26 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { checkRateLimit, withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { RATE_LIMITS } from '@nextsparkjs/core/lib/api/keys'
 import type { TeamInvitation } from '@nextsparkjs/core/lib/teams/types'
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request)
 }
 
 // POST /api/v1/team-invitations/:token/decline - Decline invitation
 export const POST = withRateLimitTier(withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ token: string }> }): Promise<NextResponse> => {
     try {
-      // Authenticate using dual auth
-      const authResult = await authenticateRequest(req)
+      // Authenticate using dual auth; the API-key scope is declared at the entry
+      // point, which fails closed for keys that lack it (#93).
+      const authResult = await authenticateRequest(req, { requiredScope: 'teams:write' })
 
       if (!authResult.success) {
-        return NextResponse.json(
-          { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-          { status: 401 }
-        )
+        return createAuthFailureResponse(authResult)
       }
 
       if (authResult.rateLimitResponse) {
@@ -47,7 +45,7 @@ export const POST = withRateLimitTier(withApiLogging(
           { retryAfter: Math.ceil((rateLimit.resetTime - Date.now()) / 1000) },
           'RATE_LIMIT_EXCEEDED'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       const { token } = await params
@@ -55,7 +53,7 @@ export const POST = withRateLimitTier(withApiLogging(
       // Validate that token is not empty
       if (!token || token.trim() === '') {
         const response = createApiError('Invitation token is required', 400, null, 'MISSING_TOKEN')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Get invitation by token
@@ -67,7 +65,7 @@ export const POST = withRateLimitTier(withApiLogging(
 
       if (!invitation) {
         const response = createApiError('Invitation not found', 404, null, 'INVITATION_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Verify invitation is for the current user's email
@@ -78,7 +76,7 @@ export const POST = withRateLimitTier(withApiLogging(
           null,
           'EMAIL_MISMATCH'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if invitation is pending
@@ -89,7 +87,7 @@ export const POST = withRateLimitTier(withApiLogging(
           null,
           'INVITATION_NOT_PENDING'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Update invitation status to declined
@@ -104,17 +102,17 @@ export const POST = withRateLimitTier(withApiLogging(
 
       if (result.rows.length === 0) {
         const response = createApiError('Invitation not found', 404, null, 'INVITATION_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       const declinedInvitation = result.rows[0]
 
       const response = createApiResponse(declinedInvitation)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     } catch (error) {
       console.error('Error declining invitation:', error)
       const response = createApiError('Internal server error', 500)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
   }
 ), 'write');

package/templates/app/api/v1/team-invitations/[token]/route.ts

@@ -11,8 +11,8 @@ import type { TeamInvitation } from '@nextsparkjs/core/lib/teams/types'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request)
 }
 
 // GET /api/v1/team-invitations/:token - Get invitation details (public endpoint for preview)
@@ -24,7 +24,7 @@ export const GET = withRateLimitTier(withApiLogging(
       // Validate that token is not empty
       if (!token || token.trim() === '') {
         const response = createApiError('Invitation token is required', 400, null, 'MISSING_TOKEN')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Get invitation by token with team and inviter details
@@ -49,14 +49,14 @@ export const GET = withRateLimitTier(withApiLogging(
 
       if (!invitation) {
         const response = createApiError('Invitation not found', 404, null, 'INVITATION_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if invitation has expired
       const expiresAt = new Date(invitation.expiresAt)
       if (expiresAt < new Date()) {
         const response = createApiError('Invitation has expired', 410, null, 'INVITATION_EXPIRED')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if invitation is still pending
@@ -67,7 +67,7 @@ export const GET = withRateLimitTier(withApiLogging(
           null,
           `INVITATION_${invitation.status.toUpperCase()}`
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Return public invitation details (don't expose sensitive data)
@@ -80,11 +80,11 @@ export const GET = withRateLimitTier(withApiLogging(
       }
 
       const response = createApiResponse(publicDetails)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     } catch (error) {
       console.error('Error fetching invitation:', error)
       const response = createApiError('Internal server error', 500)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
   }
 ), 'read');

package/templates/app/api/v1/team-invitations/route.ts

@@ -8,27 +8,25 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { invitationListQuerySchema } from '@nextsparkjs/core/lib/teams/schema'
 import type { TeamInvitation } from '@nextsparkjs/core/lib/teams/types'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request)
 }
 
 // GET /api/v1/team-invitations - List pending invitations for current user
 export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req)
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'teams:read' })
 
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-        { status: 401 }
-      )
+      return createAuthFailureResponse(authResult)
     }
 
     if (authResult.rateLimitResponse) {
@@ -106,10 +104,10 @@ export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Pr
     const paginationMeta = createPaginationMeta(page, limit, total)
 
     const response = createApiResponse(invitations, paginationMeta)
-    return addCorsHeaders(response)
+    return addCorsHeaders(response, req)
   } catch (error) {
     console.error('Error fetching invitations:', error)
     const response = createApiError('Internal server error', 500)
-    return addCorsHeaders(response)
+    return addCorsHeaders(response, req)
   }
 }), 'read');

package/templates/app/api/v1/teams/[teamId]/invitations/route.ts

@@ -8,28 +8,26 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
-import { TeamMemberService, MembershipService } from '@nextsparkjs/core/lib/services'
+import { MembershipService } from '@nextsparkjs/core/lib/services'
 import type { TeamInvitation } from '@nextsparkjs/core/lib/teams/types'
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request)
 }
 
 // GET /api/v1/teams/:teamId/invitations - List pending invitations for a team
 export const GET = withRateLimitTier(withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ teamId: string }> }): Promise<NextResponse> => {
     try {
-      // Authenticate using dual auth
-      const authResult = await authenticateRequest(req)
+      // Authenticate using dual auth; the API-key scope is declared at the entry
+      // point, which fails closed for keys that lack it (#93).
+      const authResult = await authenticateRequest(req, { requiredScope: 'teams:read' })
 
       if (!authResult.success) {
-        return NextResponse.json(
-          { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-          { status: 401 }
-        )
+        return createAuthFailureResponse(authResult)
       }
 
       if (authResult.rateLimitResponse) {
@@ -41,15 +39,22 @@ export const GET = withRateLimitTier(withApiLogging(
       // Validate that teamId is not empty
       if (!teamId || teamId.trim() === '') {
         const response = createApiError('Team ID is required', 400, null, 'MISSING_TEAM_ID')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
-      // Check if user is a member of the team
-      const isMember = await TeamMemberService.isMember(teamId, authResult.user!.id)
+      // Listing invitations — including who invited whom, to what role, and
+      // when it expires — is gated by the same 'team.members.invite'
+      // permission that already protects creating/cancelling one, not bare
+      // membership: an invitation's raw acceptance token grants whoever holds
+      // it the invitee's role, so a low-privilege member (member/viewer, who
+      // typically lack 'team.members.invite') must not be able to read it
+      // (see GHSA-rw2j-9mxg-rx98).
+      const membership = await MembershipService.get(authResult.user!.id, teamId)
+      const actionResult = membership.canPerformAction('team.members.invite')
 
-      if (!isMember) {
+      if (!actionResult.allowed) {
         const response = createApiError('Team not found or access denied', 404, null, 'TEAM_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Parse query parameters
@@ -59,15 +64,21 @@ export const GET = withRateLimitTier(withApiLogging(
       const status = searchParams.get('status') || 'pending'
       const offset = (page - 1) * limit
 
-      // Fetch team invitations
+      // Fetch team invitations — explicit column list, deliberately excluding
+      // "token": it is a bearer credential that grants the invitee's role to
+      // whoever holds it, and has no business leaving this endpoint at all
+      // (see GHSA-rw2j-9mxg-rx98). The accept flow re-derives it server-side
+      // from the URL param it already has; nothing legitimate reads it back
+      // from this list response.
       const invitations = await queryWithRLS<
-        TeamInvitation & {
+        Omit<TeamInvitation, 'token'> & {
           inviterName: string | null
           inviterEmail: string
         }
       >(
         `SELECT
-          ti.*,
+          ti.id, ti."teamId", ti.email, ti.role, ti.status, ti."invitedBy",
+          ti."expiresAt", ti."acceptedAt", ti."declinedAt", ti."createdAt", ti."updatedAt",
           u.name as "inviterName",
           u.email as "inviterEmail"
         FROM "team_invitations" ti
@@ -92,11 +103,11 @@ export const GET = withRateLimitTier(withApiLogging(
       const paginationMeta = createPaginationMeta(page, limit, total)
 
       const response = createApiResponse(invitations, paginationMeta)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     } catch (error) {
       console.error('Error fetching team invitations:', error)
       const response = createApiError('Internal server error', 500)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
   }
 ), 'read')
@@ -105,14 +116,12 @@ export const GET = withRateLimitTier(withApiLogging(
 export const DELETE = withRateLimitTier(withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ teamId: string }> }): Promise<NextResponse> => {
     try {
-      // Authenticate using dual auth
-      const authResult = await authenticateRequest(req)
+      // Authenticate using dual auth; the API-key scope is declared at the entry
+      // point, which fails closed for keys that lack it (#93).
+      const authResult = await authenticateRequest(req, { requiredScope: 'teams:write' })
 
       if (!authResult.success) {
-        return NextResponse.json(
-          { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-          { status: 401 }
-        )
+        return createAuthFailureResponse(authResult)
       }
 
       if (authResult.rateLimitResponse) {
@@ -127,12 +136,12 @@ export const DELETE = withRateLimitTier(withApiLogging(
 
       if (!invitationId) {
         const response = createApiError('Invitation ID is required', 400, null, 'MISSING_INVITATION_ID')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if user has permission to manage invitations using MembershipService
       const membership = await MembershipService.get(authResult.user!.id, teamId)
-      const actionResult = membership.canPerformAction('members.invite')
+      const actionResult = membership.canPerformAction('team.members.invite')
 
       if (!actionResult.allowed) {
         const response = NextResponse.json(
@@ -144,7 +153,7 @@ export const DELETE = withRateLimitTier(withApiLogging(
           },
           { status: 403 }
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Update invitation status to 'cancelled' (or delete it)
@@ -158,15 +167,15 @@ export const DELETE = withRateLimitTier(withApiLogging(
 
       if (result.rowCount === 0) {
         const response = createApiError('Invitation not found or already processed', 404, null, 'INVITATION_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       const response = createApiResponse({ deleted: true, id: invitationId })
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     } catch (error) {
       console.error('Error cancelling invitation:', error)
       const response = createApiError('Internal server error', 500)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
   }
 ), 'write')

package/templates/app/api/v1/teams/[teamId]/invoices/[invoiceNumber]/route.ts

@@ -7,14 +7,14 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { MembershipService } from '@nextsparkjs/core/lib/services'
 import type { InvoiceResponse } from '@nextsparkjs/core/lib/validation/invoices'
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request)
 }
 
 // GET /api/v1/teams/:teamId/invoices/:invoiceNumber - Get single invoice (owner only)
@@ -24,14 +24,13 @@ export const GET = withRateLimitTier(withApiLogging(
     { params }: { params: Promise<{ teamId: string; invoiceNumber: string }> }
   ): Promise<NextResponse> => {
     try {
-      // Authenticate using dual auth (API key OR session)
-      const authResult = await authenticateRequest(req)
+      // Authenticate using dual auth (API key OR session); the API-key scope
+      // is declared at the entry point, which fails closed for keys that
+      // lack it (#93).
+      const authResult = await authenticateRequest(req, { requiredScope: 'billing:read' })
 
       if (!authResult.success) {
-        return NextResponse.json(
-          { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-          { status: 401 }
-        )
+        return createAuthFailureResponse(authResult)
       }
 
       if (authResult.rateLimitResponse) {
@@ -43,18 +42,18 @@ export const GET = withRateLimitTier(withApiLogging(
       // Validate that teamId is not empty
       if (!teamId || teamId.trim() === '') {
         const response = createApiError('Team ID is required', 400, null, 'MISSING_TEAM_ID')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Validate that invoiceNumber is not empty
       if (!invoiceNumber || invoiceNumber.trim() === '') {
         const response = createApiError('Invoice number is required', 400, null, 'MISSING_INVOICE_NUMBER')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if user has permission to view invoices using MembershipService
       const membership = await MembershipService.get(authResult.user!.id, teamId)
-      const actionResult = membership.canPerformAction('billing.invoices')
+      const actionResult = membership.canPerformAction('team.billing.view')
 
       if (!actionResult.allowed) {
         const response = NextResponse.json(
@@ -66,7 +65,7 @@ export const GET = withRateLimitTier(withApiLogging(
           },
           { status: 403 }
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Query single invoice by invoiceNumber
@@ -92,15 +91,15 @@ export const GET = withRateLimitTier(withApiLogging(
 
       if (invoices.length === 0) {
         const response = createApiError('Invoice not found', 404, null, 'INVOICE_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       const response = createApiResponse(invoices[0])
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     } catch (error) {
       console.error('Error fetching invoice:', error)
       const response = createApiError('Internal server error', 500)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
   }
 ), 'read')