@nextsparkjs/core 0.1.0-beta.185 → 0.1.0-beta.187

package/templates/app/api/v1/teams/[teamId]/invoices/route.ts

@@ -8,29 +8,28 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { MembershipService } from '@nextsparkjs/core/lib/services'
 import { invoiceQuerySchema } from '@nextsparkjs/core/lib/validation/invoices'
 import type { InvoiceResponse } from '@nextsparkjs/core/lib/validation/invoices'
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request)
 }
 
 // GET /api/v1/teams/:teamId/invoices - List team invoices (owner only)
 export const GET = withRateLimitTier(withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ teamId: string }> }): Promise<NextResponse> => {
     try {
-      // Authenticate using dual auth (API key OR session)
-      const authResult = await authenticateRequest(req)
+      // Authenticate using dual auth (API key OR session); the API-key scope
+      // is declared at the entry point, which fails closed for keys that
+      // lack it (#93).
+      const authResult = await authenticateRequest(req, { requiredScope: 'billing:read' })
 
       if (!authResult.success) {
-        return NextResponse.json(
-          { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-          { status: 401 }
-        )
+        return createAuthFailureResponse(authResult)
       }
 
       if (authResult.rateLimitResponse) {
@@ -42,12 +41,12 @@ export const GET = withRateLimitTier(withApiLogging(
       // Validate that teamId is not empty
       if (!teamId || teamId.trim() === '') {
         const response = createApiError('Team ID is required', 400, null, 'MISSING_TEAM_ID')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if user has permission to view invoices using MembershipService
       const membership = await MembershipService.get(authResult.user!.id, teamId)
-      const actionResult = membership.canPerformAction('billing.invoices')
+      const actionResult = membership.canPerformAction('team.billing.view')
 
       if (!actionResult.allowed) {
         const response = NextResponse.json(
@@ -59,7 +58,7 @@ export const GET = withRateLimitTier(withApiLogging(
           },
           { status: 403 }
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Parse query parameters for pagination
@@ -110,17 +109,17 @@ export const GET = withRateLimitTier(withApiLogging(
       const paginationMeta = createPaginationMeta(page, limit, total)
 
       const response = createApiResponse(invoices, paginationMeta)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     } catch (error) {
       if (error instanceof Error && error.name === 'ZodError') {
         const zodError = error as { issues?: unknown[] }
         const response = createApiError('Validation error', 400, zodError.issues, 'VALIDATION_ERROR')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       console.error('Error fetching invoices:', error)
       const response = createApiError('Internal server error', 500)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
   }
 ), 'read')

package/templates/app/api/v1/teams/[teamId]/members/[memberId]/route.ts

@@ -7,7 +7,7 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { updateMemberRoleSchema } from '@nextsparkjs/core/lib/teams/schema'
 import { MembershipService } from '@nextsparkjs/core/lib/services'
@@ -15,8 +15,8 @@ import { validateRoleTransition, canManageRole } from '@nextsparkjs/core/lib/tea
 import type { TeamMember, TeamRole } from '@nextsparkjs/core/lib/teams/types'
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request)
 }
 
 // PATCH /api/v1/teams/:teamId/members/:memberId - Update member role
@@ -26,14 +26,12 @@ export const PATCH = withRateLimitTier(withApiLogging(
     { params }: { params: Promise<{ teamId: string; memberId: string }> }
   ): Promise<NextResponse> => {
     try {
-      // Authenticate using dual auth
-      const authResult = await authenticateRequest(req)
+      // Authenticate using dual auth; the API-key scope is declared at the entry
+      // point, which fails closed for keys that lack it (#93).
+      const authResult = await authenticateRequest(req, { requiredScope: 'teams:write' })
 
       if (!authResult.success) {
-        return NextResponse.json(
-          { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-          { status: 401 }
-        )
+        return createAuthFailureResponse(authResult)
       }
 
       if (authResult.rateLimitResponse) {
@@ -45,17 +43,17 @@ export const PATCH = withRateLimitTier(withApiLogging(
       // Validate parameters
       if (!teamId || teamId.trim() === '') {
         const response = createApiError('Team ID is required', 400, null, 'MISSING_TEAM_ID')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       if (!memberId || memberId.trim() === '') {
         const response = createApiError('Member ID is required', 400, null, 'MISSING_MEMBER_ID')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if user has permission to update member roles using MembershipService
       const membership = await MembershipService.get(authResult.user!.id, teamId)
-      const actionResult = membership.canPerformAction('members.update_role')
+      const actionResult = membership.canPerformAction('team.members.update_role')
 
       if (!actionResult.allowed) {
         const response = NextResponse.json(
@@ -67,7 +65,7 @@ export const PATCH = withRateLimitTier(withApiLogging(
           },
           { status: 403 }
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Get user's role for role hierarchy validation
@@ -82,7 +80,7 @@ export const PATCH = withRateLimitTier(withApiLogging(
 
       if (!targetMember) {
         const response = createApiError('Member not found', 404, null, 'MEMBER_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       const body = await req.json()
@@ -93,7 +91,7 @@ export const PATCH = withRateLimitTier(withApiLogging(
 
       if (!transitionValidation.allowed) {
         const response = createApiError(transitionValidation.reason || 'Invalid role transition', 403, null, 'INVALID_ROLE_TRANSITION')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if actor can manage the target role
@@ -104,7 +102,7 @@ export const PATCH = withRateLimitTier(withApiLogging(
           null,
           'INSUFFICIENT_PERMISSIONS'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Update member role
@@ -119,7 +117,7 @@ export const PATCH = withRateLimitTier(withApiLogging(
 
       if (result.rows.length === 0) {
         const response = createApiError('Member not found', 404, null, 'MEMBER_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Fetch member with user details
@@ -143,17 +141,17 @@ export const PATCH = withRateLimitTier(withApiLogging(
       )
 
       const response = createApiResponse(memberWithUser)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     } catch (error) {
       if (error instanceof Error && error.name === 'ZodError') {
         const zodError = error as { issues?: unknown[] }
         const response = createApiError('Validation error', 400, zodError.issues, 'VALIDATION_ERROR')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       console.error('Error updating member role:', error)
       const response = createApiError('Internal server error', 500)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
   }
 ), 'write')
@@ -165,14 +163,12 @@ export const DELETE = withRateLimitTier(withApiLogging(
     { params }: { params: Promise<{ teamId: string; memberId: string }> }
   ): Promise<NextResponse> => {
     try {
-      // Authenticate using dual auth
-      const authResult = await authenticateRequest(req)
+      // Authenticate using dual auth; the API-key scope is declared at the entry
+      // point, which fails closed for keys that lack it (#93).
+      const authResult = await authenticateRequest(req, { requiredScope: 'teams:write' })
 
       if (!authResult.success) {
-        return NextResponse.json(
-          { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-          { status: 401 }
-        )
+        return createAuthFailureResponse(authResult)
       }
 
       if (authResult.rateLimitResponse) {
@@ -184,17 +180,17 @@ export const DELETE = withRateLimitTier(withApiLogging(
       // Validate parameters
       if (!teamId || teamId.trim() === '') {
         const response = createApiError('Team ID is required', 400, null, 'MISSING_TEAM_ID')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       if (!memberId || memberId.trim() === '') {
         const response = createApiError('Member ID is required', 400, null, 'MISSING_MEMBER_ID')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if user has permission to remove members using MembershipService
       const membership = await MembershipService.get(authResult.user!.id, teamId)
-      const actionResult = membership.canPerformAction('members.remove')
+      const actionResult = membership.canPerformAction('team.members.remove')
 
       if (!actionResult.allowed) {
         const response = NextResponse.json(
@@ -206,7 +202,7 @@ export const DELETE = withRateLimitTier(withApiLogging(
           },
           { status: 403 }
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Get user's role for role hierarchy validation
@@ -221,13 +217,13 @@ export const DELETE = withRateLimitTier(withApiLogging(
 
       if (!targetMember) {
         const response = createApiError('Member not found', 404, null, 'MEMBER_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Cannot remove the owner
       if (targetMember.role === 'owner') {
         const response = createApiError('Cannot remove the team owner', 403, null, 'CANNOT_REMOVE_OWNER')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if actor can manage the target role
@@ -238,7 +234,7 @@ export const DELETE = withRateLimitTier(withApiLogging(
           null,
           'INSUFFICIENT_PERMISSIONS'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Remove member
@@ -250,15 +246,15 @@ export const DELETE = withRateLimitTier(withApiLogging(
 
       if (result.rows.length === 0) {
         const response = createApiError('Member not found', 404, null, 'MEMBER_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       const response = createApiResponse({ deleted: true, id: memberId })
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     } catch (error) {
       console.error('Error removing member:', error)
       const response = createApiError('Internal server error', 500)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
   }
 ), 'write')

package/templates/app/api/v1/teams/[teamId]/members/route.ts

@@ -8,7 +8,7 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { isSuperAdmin } from '@nextsparkjs/core/lib/api/auth/permissions'
 import { checkRateLimit, withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { RATE_LIMITS } from '@nextsparkjs/core/lib/api/keys'
@@ -21,22 +21,20 @@ import { sendTeamInvitationEmail } from '@nextsparkjs/core/lib/email/send'
 import { I18N_CONFIG } from '@nextsparkjs/core/lib/config'
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request)
 }
 
 // GET /api/v1/teams/:teamId/members - List team members
 export const GET = withRateLimitTier(withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ teamId: string }> }): Promise<NextResponse> => {
     try {
-      // Authenticate using dual auth
-      const authResult = await authenticateRequest(req)
+      // Authenticate using dual auth; the API-key scope is declared at the entry
+      // point, which fails closed for keys that lack it (#93).
+      const authResult = await authenticateRequest(req, { requiredScope: 'teams:read' })
 
       if (!authResult.success) {
-        return NextResponse.json(
-          { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-          { status: 401 }
-        )
+        return createAuthFailureResponse(authResult)
       }
 
       if (authResult.rateLimitResponse) {
@@ -48,19 +46,23 @@ export const GET = withRateLimitTier(withApiLogging(
       // Validate that teamId is not empty
       if (!teamId || teamId.trim() === '') {
         const response = createApiError('Team ID is required', 400, null, 'MISSING_TEAM_ID')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Superadmins can view members of any team
       const userIsSuperAdmin = isSuperAdmin(authResult)
 
-      // Check if user is a member of the team (unless superadmin)
+      // Listing the roster is gated by the 'team.members.view' permission, not
+      // bare membership — membership only proves you belong to the team, not
+      // that your role is allowed to see who else does (a theme may grant
+      // 'team.members.view' to a subset of roles; see GHSA-rw2j-9mxg-rx98).
       if (!userIsSuperAdmin) {
-        const isMember = await TeamMemberService.isMember(teamId, authResult.user!.id)
+        const membership = await MembershipService.get(authResult.user!.id, teamId)
+        const actionResult = membership.canPerformAction('team.members.view')
 
-        if (!isMember) {
+        if (!actionResult.allowed) {
           const response = createApiError('Team not found or access denied', 404, null, 'TEAM_NOT_FOUND')
-          return addCorsHeaders(response)
+          return addCorsHeaders(response, req)
         }
       }
 
@@ -141,11 +143,11 @@ export const GET = withRateLimitTier(withApiLogging(
       const paginationMeta = createPaginationMeta(page, limit, total)
 
       const response = createApiResponse(members, paginationMeta)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     } catch (error) {
       console.error('Error fetching team members:', error)
       const response = createApiError('Internal server error', 500)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
   }
 ), 'read')
@@ -154,14 +156,12 @@ export const GET = withRateLimitTier(withApiLogging(
 export const POST = withRateLimitTier(withApiLogging(
   async (req: NextRequest, { params }: { params: Promise<{ teamId: string }> }): Promise<NextResponse> => {
     try {
-      // Authenticate using dual auth
-      const authResult = await authenticateRequest(req)
+      // Authenticate using dual auth; the API-key scope is declared at the entry
+      // point, which fails closed for keys that lack it (#93).
+      const authResult = await authenticateRequest(req, { requiredScope: 'teams:write' })
 
       if (!authResult.success) {
-        return NextResponse.json(
-          { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-          { status: 401 }
-        )
+        return createAuthFailureResponse(authResult)
       }
 
       if (authResult.rateLimitResponse) {
@@ -180,7 +180,7 @@ export const POST = withRateLimitTier(withApiLogging(
           { retryAfter: Math.ceil((rateLimit.resetTime - Date.now()) / 1000) },
           'RATE_LIMIT_EXCEEDED'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       const { teamId } = await params
@@ -188,12 +188,12 @@ export const POST = withRateLimitTier(withApiLogging(
       // Validate that teamId is not empty
       if (!teamId || teamId.trim() === '') {
         const response = createApiError('Team ID is required', 400, null, 'MISSING_TEAM_ID')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if user has permission to invite members using MembershipService
       const membership = await MembershipService.get(authResult.user!.id, teamId)
-      const actionResult = membership.canPerformAction('members.invite')
+      const actionResult = membership.canPerformAction('team.members.invite')
 
       if (!actionResult.allowed) {
         const response = NextResponse.json(
@@ -205,7 +205,7 @@ export const POST = withRateLimitTier(withApiLogging(
           },
           { status: 403 }
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Get user's role for role hierarchy validation
@@ -223,7 +223,7 @@ export const POST = withRateLimitTier(withApiLogging(
           null,
           'ROLE_HIERARCHY_VIOLATION'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Check if user already exists and is already a member
@@ -243,7 +243,7 @@ export const POST = withRateLimitTier(withApiLogging(
 
         if (existingMember) {
           const response = createApiError('User is already a member of this team', 409, null, 'ALREADY_MEMBER')
-          return addCorsHeaders(response)
+          return addCorsHeaders(response, req)
         }
       }
 
@@ -262,7 +262,7 @@ export const POST = withRateLimitTier(withApiLogging(
           null,
           'INVITATION_EXISTS'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Get team info for email
@@ -274,7 +274,7 @@ export const POST = withRateLimitTier(withApiLogging(
 
       if (!team) {
         const response = createApiError('Team not found', 404, null, 'TEAM_NOT_FOUND')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       // Create invitation
@@ -333,17 +333,17 @@ export const POST = withRateLimitTier(withApiLogging(
       }
 
       const response = createApiResponse(invitation, { created: true }, 201)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     } catch (error) {
       if (error instanceof Error && error.name === 'ZodError') {
         const zodError = error as { issues?: unknown[] }
         const response = createApiError('Validation error', 400, zodError.issues, 'VALIDATION_ERROR')
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
 
       console.error('Error creating invitation:', error)
       const response = createApiError('Internal server error', 500)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
   }
 ), 'write')