@nextsparkjs/core 0.1.0-beta.7 → 0.1.0-beta.70

package/dist/templates/app/accept-invite/[token]/page.tsx

@@ -9,7 +9,7 @@ import { Alert, AlertDescription, AlertTitle } from '@nextsparkjs/core/component
 import { Loader2, CheckCircle, XCircle, Users, LogIn, UserPlus } from 'lucide-react'
 import { toast } from 'sonner'
 import Link from 'next/link'
-import { createCyId } from '@nextsparkjs/core/lib/test'
+import { sel } from '@nextsparkjs/core/selectors'
 
 type InvitationStatus = 'loading' | 'valid' | 'accepting' | 'accepted' | 'error' | 'expired' | 'not_found' | 'email_mismatch' | 'already_member' | 'requires_auth'
 
@@ -183,7 +183,7 @@ export default function AcceptInvitePage() {
 
   if (authLoading || status === 'loading') {
     return (
-      <div className="min-h-screen flex items-center justify-center bg-background" data-cy={createCyId('accept-invite', 'loading')}>
+      <div className="min-h-screen flex items-center justify-center bg-background" data-cy={sel('teams.acceptInvite.loading')}>
         <Card className="w-full max-w-md">
           <CardContent className="flex flex-col items-center py-10">
             <Loader2 className="h-10 w-10 animate-spin text-primary" />
@@ -195,8 +195,8 @@ export default function AcceptInvitePage() {
   }
 
   return (
-    <div className="min-h-screen flex items-center justify-center bg-background p-4" data-cy={createCyId('accept-invite', 'container')}>
-      <Card className="w-full max-w-md" data-cy={createCyId('accept-invite', 'info')}>
+    <div className="min-h-screen flex items-center justify-center bg-background p-4" data-cy={sel('teams.acceptInvite.container')}>
+      <Card className="w-full max-w-md" data-cy={sel('teams.acceptInvite.info')}>
         <CardHeader className="text-center">
           <div className="mx-auto mb-4 flex h-16 w-16 items-center justify-center rounded-full bg-primary/10">
             <Users className="h-8 w-8 text-primary" />
@@ -204,7 +204,7 @@ export default function AcceptInvitePage() {
           <CardTitle className="text-2xl">Team Invitation</CardTitle>
           <CardDescription>
             {invitationInfo && (
-              <>You&apos;ve been invited to join <strong data-cy={createCyId('accept-invite', 'team-name')}>{invitationInfo.teamName}</strong></>
+              <>You&apos;ve been invited to join <strong data-cy={sel('teams.acceptInvite.teamName')}>{invitationInfo.teamName}</strong></>
             )}
           </CardDescription>
         </CardHeader>
@@ -212,10 +212,10 @@ export default function AcceptInvitePage() {
         <CardContent className="space-y-6">
           {/* Requires Authentication */}
           {status === 'requires_auth' && invitationInfo && (
-            <div data-cy={createCyId('accept-invite', 'requires-auth')}>
+            <div data-cy={sel('teams.acceptInvite.requiresAuth')}>
               <div className="rounded-lg border p-4 space-y-2">
                 <p className="text-sm text-muted-foreground">
-                  <strong data-cy={createCyId('accept-invite', 'inviter')}>{invitationInfo.inviterName}</strong> has invited you to join <strong>{invitationInfo.teamName}</strong> as a <strong data-cy={createCyId('accept-invite', 'role')}>{invitationInfo.role}</strong>.
+                  <strong data-cy={sel('teams.acceptInvite.inviter')}>{invitationInfo.inviterName}</strong> has invited you to join <strong>{invitationInfo.teamName}</strong> as a <strong data-cy={sel('teams.acceptInvite.role')}>{invitationInfo.role}</strong>.
                 </p>
                 <p className="text-sm text-muted-foreground">
                   This invitation was sent to <strong>{invitationInfo.email}</strong>
@@ -226,13 +226,13 @@ export default function AcceptInvitePage() {
                 <p className="text-sm text-center text-muted-foreground">
                   Please sign in or create an account to accept this invitation.
                 </p>
-                <Button asChild className="w-full" data-cy={createCyId('accept-invite', 'signin')}>
+                <Button asChild className="w-full" data-cy={sel('teams.acceptInvite.signin')}>
                   <Link href={loginUrl}>
                     <LogIn className="mr-2 h-4 w-4" />
                     Sign In
                   </Link>
                 </Button>
-                <Button asChild variant="outline" className="w-full" data-cy={createCyId('accept-invite', 'signup')}>
+                <Button asChild variant="outline" className="w-full" data-cy={sel('teams.acceptInvite.signup')}>
                   <Link href={signupUrl}>
                     <UserPlus className="mr-2 h-4 w-4" />
                     Create Account
@@ -244,14 +244,14 @@ export default function AcceptInvitePage() {
 
           {/* Valid - Ready to Accept */}
           {status === 'valid' && invitationInfo && (
-            <div data-cy={createCyId('accept-invite', 'valid')}>
+            <div data-cy={sel('teams.acceptInvite.valid')}>
               <div className="rounded-lg border p-4 space-y-2">
                 <p className="text-sm text-muted-foreground">
                   <strong>{invitationInfo.inviterName}</strong> has invited you to join <strong>{invitationInfo.teamName}</strong> as a <strong>{invitationInfo.role}</strong>.
                 </p>
               </div>
 
-              <Button onClick={handleAccept} className="w-full mt-6" data-cy={createCyId('accept-invite', 'accept')}>
+              <Button onClick={handleAccept} className="w-full mt-6" data-cy={sel('teams.acceptInvite.accept')}>
                 Accept Invitation
               </Button>
             </div>
@@ -259,7 +259,7 @@ export default function AcceptInvitePage() {
 
           {/* Accepting */}
           {status === 'accepting' && (
-            <div className="flex flex-col items-center py-4" data-cy={createCyId('accept-invite', 'accepting')}>
+            <div className="flex flex-col items-center py-4" data-cy={sel('teams.acceptInvite.accepting')}>
               <Loader2 className="h-8 w-8 animate-spin text-primary" />
               <p className="mt-4 text-muted-foreground">Accepting invitation...</p>
             </div>
@@ -267,7 +267,7 @@ export default function AcceptInvitePage() {
 
           {/* Accepted */}
           {status === 'accepted' && (
-            <Alert className="border-green-200 bg-green-50" data-cy={createCyId('accept-invite', 'success')}>
+            <Alert className="border-green-200 bg-green-50" data-cy={sel('teams.acceptInvite.success')}>
               <CheckCircle className="h-5 w-5 text-green-600" />
               <AlertTitle className="text-green-800">Welcome to the team!</AlertTitle>
               <AlertDescription className="text-green-700">
@@ -278,7 +278,7 @@ export default function AcceptInvitePage() {
 
           {/* Already Member */}
           {status === 'already_member' && (
-            <Alert className="border-blue-200 bg-blue-50" data-cy={createCyId('accept-invite', 'already-member')}>
+            <Alert className="border-blue-200 bg-blue-50" data-cy={sel('teams.acceptInvite.alreadyMember')}>
               <CheckCircle className="h-5 w-5 text-blue-600" />
               <AlertTitle className="text-blue-800">Already a member</AlertTitle>
               <AlertDescription className="text-blue-700">
@@ -292,7 +292,7 @@ export default function AcceptInvitePage() {
 
           {/* Email Mismatch */}
           {status === 'email_mismatch' && (
-            <Alert variant="destructive" data-cy={createCyId('accept-invite', 'email-mismatch')}>
+            <Alert variant="destructive" data-cy={sel('teams.acceptInvite.emailMismatch')}>
               <XCircle className="h-5 w-5" />
               <AlertTitle>Email mismatch</AlertTitle>
               <AlertDescription>
@@ -307,7 +307,7 @@ export default function AcceptInvitePage() {
 
           {/* Not Found */}
           {status === 'not_found' && (
-            <Alert variant="destructive" data-cy={createCyId('accept-invite', 'not-found')}>
+            <Alert variant="destructive" data-cy={sel('teams.acceptInvite.notFound')}>
               <XCircle className="h-5 w-5" />
               <AlertTitle>Invitation not found</AlertTitle>
               <AlertDescription>
@@ -318,7 +318,7 @@ export default function AcceptInvitePage() {
 
           {/* Expired */}
           {status === 'expired' && (
-            <Alert variant="destructive" data-cy={createCyId('accept-invite', 'expired')}>
+            <Alert variant="destructive" data-cy={sel('teams.acceptInvite.expired')}>
               <XCircle className="h-5 w-5" />
               <AlertTitle>Invitation expired</AlertTitle>
               <AlertDescription>
@@ -329,7 +329,7 @@ export default function AcceptInvitePage() {
 
           {/* Generic Error */}
           {status === 'error' && (
-            <Alert variant="destructive" data-cy={createCyId('accept-invite', 'error')}>
+            <Alert variant="destructive" data-cy={sel('teams.acceptInvite.error')}>
               <XCircle className="h-5 w-5" />
               <AlertTitle>Error</AlertTitle>
               <AlertDescription>{errorMessage || 'An error occurred. Please try again.'}</AlertDescription>

package/dist/templates/app/api/auth/[...all]/route.ts

@@ -4,9 +4,15 @@ import { NextRequest, NextResponse } from "next/server";
 import { TEAMS_CONFIG } from "@nextsparkjs/core/lib/config";
 import { isPublicSignupRestricted } from "@nextsparkjs/core/lib/teams/helpers";
 import { TeamService } from "@nextsparkjs/core/lib/services";
+import { wrapAuthHandlerWithCors, handleCorsPreflightRequest, addCorsHeaders } from "@nextsparkjs/core/lib/api/helpers";
 
 const handlers = toNextJsHandler(auth);
 
+// Handle CORS preflight requests for cross-origin auth (mobile apps, etc.)
+export async function OPTIONS(req: NextRequest) {
+  return handleCorsPreflightRequest(req);
+}
+
 // Intercept email verification requests to redirect to UI page
 // eslint-disable-next-line @typescript-eslint/no-unused-vars
 export async function GET(req: NextRequest, context: { params: Promise<{ all: string[] }> }) {
@@ -31,8 +37,8 @@ export async function GET(req: NextRequest, context: { params: Promise<{ all: st
     }
   }
 
-  // For all other requests (including UI verification calls), use the default Better Auth handler
-  return handlers.GET(req);
+  // Wrap with CORS headers for cross-origin requests (mobile apps, etc.)
+  return wrapAuthHandlerWithCors(() => handlers.GET(req), req);
 }
 
 // Intercept signup requests to validate single-tenant mode
@@ -53,7 +59,8 @@ export async function POST(req: NextRequest) {
 
       if (teamExists) {
         // Block public signup - users must be invited
-        return NextResponse.json(
+        // Add CORS headers so mobile apps can read the error message
+        const errorResponse = NextResponse.json(
           {
             error: 'Registration is closed',
             message: 'This application requires an invitation to register. Please contact an administrator.',
@@ -61,10 +68,11 @@ export async function POST(req: NextRequest) {
           },
           { status: 403 }
         );
+        return await addCorsHeaders(errorResponse, req);
       }
     }
   }
 
-  // Continue with normal Better Auth handling
-  return handlers.POST(req);
+  // Wrap with CORS headers for cross-origin requests (mobile apps, etc.)
+  return wrapAuthHandlerWithCors(() => handlers.POST(req), req);
 }

package/dist/templates/app/api/csp-report/route.ts

@@ -0,0 +1,106 @@
+import { randomUUID } from 'node:crypto';
+import { NextRequest, NextResponse } from 'next/server';
+
+/**
+ * CSP Violation Report Endpoint
+ *
+ * Receives Content-Security-Policy violation reports from browsers.
+ * Reports are logged for monitoring and debugging CSP issues.
+ *
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP#violation_report_syntax
+ */
+
+interface CSPViolationReport {
+  'csp-report'?: {
+    'document-uri'?: string;
+    'referrer'?: string;
+    'violated-directive'?: string;
+    'effective-directive'?: string;
+    'original-policy'?: string;
+    'disposition'?: string;
+    'blocked-uri'?: string;
+    'line-number'?: number;
+    'column-number'?: number;
+    'source-file'?: string;
+    'status-code'?: number;
+    'script-sample'?: string;
+  };
+}
+
+// Get allowed origin from environment or use localhost fallback
+const getAllowedOrigin = () => {
+  return process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000';
+};
+
+export async function POST(request: NextRequest) {
+  const requestId = randomUUID().slice(0, 8);
+
+  try {
+    const contentType = request.headers.get('content-type') || '';
+
+    // CSP reports are sent as application/csp-report or application/json
+    if (!contentType.includes('application/csp-report') && !contentType.includes('application/json')) {
+      console.warn(`[CSP Report ${requestId}] Invalid content-type: ${contentType}`);
+      return new NextResponse('Invalid content type', { status: 400 });
+    }
+
+    let rawBody: string | undefined;
+    try {
+      rawBody = await request.text();
+      const report: CSPViolationReport = JSON.parse(rawBody);
+      const violation = report['csp-report'];
+
+      if (!violation) {
+        console.warn(`[CSP Report ${requestId}] Invalid report format - missing csp-report key`, {
+          bodyPreview: rawBody.slice(0, 200),
+        });
+        return new NextResponse('Invalid report format', { status: 400 });
+      }
+
+      // Log the violation for monitoring
+      // In production, you might want to send this to a logging service like Datadog, Sentry, etc.
+      console.warn(`[CSP Violation ${requestId}]`, {
+        documentUri: violation['document-uri'],
+        blockedUri: violation['blocked-uri'],
+        violatedDirective: violation['violated-directive'],
+        effectiveDirective: violation['effective-directive'],
+        sourceFile: violation['source-file'],
+        lineNumber: violation['line-number'],
+        columnNumber: violation['column-number'],
+        scriptSample: violation['script-sample'],
+        disposition: violation['disposition'],
+        timestamp: new Date().toISOString(),
+      });
+
+      // Return 204 No Content - browsers don't expect a response body
+      return new NextResponse(null, { status: 204 });
+    } catch (parseError) {
+      console.error(`[CSP Report ${requestId}] JSON parse error:`, {
+        error: parseError instanceof Error ? parseError.message : 'Unknown error',
+        bodyPreview: rawBody?.slice(0, 200),
+      });
+      // Still return 204 to not break browser behavior
+      return new NextResponse(null, { status: 204 });
+    }
+  } catch (error) {
+    console.error(`[CSP Report ${requestId}] Unexpected error:`, {
+      error: error instanceof Error ? error.message : 'Unknown error',
+      stack: error instanceof Error ? error.stack : undefined,
+    });
+    // Still return 204 to not break browser behavior
+    return new NextResponse(null, { status: 204 });
+  }
+}
+
+// Handle preflight requests for CORS
+// Restrict to same origin instead of allowing all origins
+export async function OPTIONS() {
+  return new NextResponse(null, {
+    status: 204,
+    headers: {
+      'Access-Control-Allow-Origin': getAllowedOrigin(),
+      'Access-Control-Allow-Methods': 'POST, OPTIONS',
+      'Access-Control-Allow-Headers': 'Content-Type',
+    },
+  });
+}

package/dist/templates/app/api/devtools/config/entities/route.ts

@@ -2,6 +2,7 @@ import { getTypedSession } from "@nextsparkjs/core/lib/auth";
 import { NextResponse } from "next/server";
 import { getEntityRegistry } from "@nextsparkjs/core/lib/entities/queries";
 import type { EntityConfig, ChildEntityDefinition } from "@nextsparkjs/core/lib/entities/types";
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 // Type guard to check if entity is a full EntityConfig
 function isEntityConfig(entity: EntityConfig | ChildEntityDefinition): entity is EntityConfig {
@@ -29,11 +30,8 @@ interface EntityInfo {
     label?: string;
     required?: boolean;
   }[];
-  // Permissions are now optional in entity config (centralized in permissions.config.ts)
-  permissions?: {
-    actions: Array<{ action: string; label: string; description?: string }>;
-    customActions?: Array<{ action: string; label: string; description?: string }>;
-  };
+  // Note: Permissions are now defined centrally in permissions.config.ts
+  // Use PermissionService to query entity permissions
 }
 
 /**
@@ -42,7 +40,7 @@ interface EntityInfo {
  * Returns entity registry information
  * Only accessible to developer role
  */
-export async function GET(request: Request) {
+export const GET = withRateLimitTier(async (request: Request) => {
   try {
     // Verify developer role
     const session = await getTypedSession(request.headers);
@@ -62,7 +60,8 @@ export async function GET(request: Request) {
     const registry = getEntityRegistry();
 
     for (const [, entry] of Object.entries(registry)) {
-      const config = entry.config;
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const config = (entry as any).config;
       if (!isEntityConfig(config)) continue;
 
       entities.push({
@@ -83,7 +82,7 @@ export async function GET(request: Request) {
           label: field.label,
           required: field.required,
         })) || [],
-        permissions: config.permissions,
+        // Note: Permissions are now centralized in permissions.config.ts
       });
     }
 
@@ -114,4 +113,4 @@ export async function GET(request: Request) {
       { status: 500 }
     );
   }
-}
+}, 'read');

package/dist/templates/app/api/devtools/config/theme/route.ts

@@ -1,6 +1,7 @@
 import { getTypedSession } from "@nextsparkjs/core/lib/auth";
 import { NextResponse } from "next/server";
 import { ThemeService } from "@nextsparkjs/core/lib/services/theme.service";
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 /**
  * GET /api/devtools/config/theme
@@ -8,7 +9,7 @@ import { ThemeService } from "@nextsparkjs/core/lib/services/theme.service";
  * Returns current theme configuration
  * Only accessible to developer role
  */
-export async function GET(request: Request) {
+export const GET = withRateLimitTier(async (request: Request) => {
   try {
     // Verify developer role
     const session = await getTypedSession(request.headers);
@@ -63,4 +64,4 @@ export async function GET(request: Request) {
       { status: 500 }
     );
   }
-}
+}, 'read');

package/dist/templates/app/api/devtools/tests/[...path]/route.ts

@@ -3,6 +3,7 @@ import { NextResponse } from "next/server";
 import { readFile, stat } from "fs/promises";
 import { join } from "path";
 import matter from "gray-matter";
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 /**
  * GET /api/devtools/tests/[...path]
@@ -12,10 +13,10 @@ import matter from "gray-matter";
  *
  * @param path - Array of path segments (e.g., ['auth', 'login.md'])
  */
-export async function GET(
+export const GET = withRateLimitTier(async (
   request: Request,
   { params }: { params: Promise<{ path: string[] }> }
-) {
+) => {
   try {
     // Verify developer role
     const session = await getTypedSession(request.headers);
@@ -127,4 +128,4 @@ export async function GET(
       { status: 500 }
     );
   }
-}
+}, 'read');

package/dist/templates/app/api/devtools/tests/route.ts

@@ -2,6 +2,7 @@ import { getTypedSession } from "@nextsparkjs/core/lib/auth";
 import { NextResponse } from "next/server";
 import { readdir, stat } from "fs/promises";
 import { join } from "path";
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 /**
  * File tree node structure
@@ -58,7 +59,7 @@ async function buildFileTree(dirPath: string, basePath: string): Promise<FileTre
  * Returns file tree structure of test documentation files
  * Only accessible to developer role
  */
-export async function GET(request: Request) {
+export const GET = withRateLimitTier(async (request: Request) => {
   try {
     // Verify developer role
     const session = await getTypedSession(request.headers);
@@ -131,4 +132,4 @@ export async function GET(request: Request) {
       { status: 500 }
     );
   }
-}
+}, 'read');

package/dist/templates/app/api/health/route.ts

@@ -1,11 +1,13 @@
 import { queryWithRLS } from "@nextsparkjs/core/lib/db";
+import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
+import { NextResponse } from "next/server";
 
-export async function GET() {
+export const GET = withRateLimitTier(async () => {
   try {
     // Test database connection
     await queryWithRLS('SELECT 1');
     
-    return Response.json({ 
+    return NextResponse.json({
       status: 'healthy',
       timestamp: new Date().toISOString(),
       services: {
@@ -15,7 +17,7 @@ export async function GET() {
     });
   } catch (error) {
     console.error('Health check failed:', error);
-    return Response.json({ 
+    return NextResponse.json({
       status: 'unhealthy',
       timestamp: new Date().toISOString(),
       error: 'Database connection failed',
@@ -25,5 +27,5 @@ export async function GET() {
       }
     }, { status: 503 });
   }
-}
+}, 'read');
 

package/dist/templates/app/api/internal/user-metadata/route.ts

@@ -1,8 +1,9 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { MetaService } from '@nextsparkjs/core/lib/services/meta.service'
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 // Endpoint interno para crear metadata default después del signup
-export async function POST(req: NextRequest) {
+export const POST = withRateLimitTier(async (req: NextRequest) => {
   try {
     const body = await req.json()
     const { userId, metadata } = body
@@ -33,4 +34,4 @@ export async function POST(req: NextRequest) {
       error: 'Internal server error'
     }, { status: 500 })
   }
-}
+}, 'write');

package/dist/templates/app/api/superadmin/subscriptions/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { getTypedSession } from '@nextsparkjs/core/lib/auth';
 import { queryWithRLS } from '@nextsparkjs/core/lib/db';
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 interface SubscriptionResult {
   id: string;
@@ -51,7 +52,7 @@ interface PlanDistribution {
  * Retrieves all subscriptions with stats for superadmin overview.
  * Supports filtering by status and pagination.
  */
-export async function GET(request: NextRequest) {
+export const GET = withRateLimitTier(async (request: NextRequest) => {
   try {
     // Get the current session using Better Auth
     const session = await getTypedSession(request.headers);
@@ -305,4 +306,4 @@ export async function GET(request: NextRequest) {
       { status: 500 }
     );
   }
-}
+}, 'strict');

package/dist/templates/app/api/superadmin/teams/[teamId]/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { getTypedSession } from '@nextsparkjs/core/lib/auth';
 import { queryWithRLS } from '@nextsparkjs/core/lib/db';
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 interface TeamResult {
   id: string;
@@ -62,10 +63,10 @@ interface UsageResult {
  * Retrieves a single team with owner info and members.
  * Only accessible by superadmin or developer users.
  */
-export async function GET(
+export const GET = withRateLimitTier(async (
   request: NextRequest,
   { params }: { params: Promise<{ teamId: string }> }
-) {
+) => {
   try {
     const { teamId } = await params;
 
@@ -281,4 +282,4 @@ export async function GET(
       { status: 500 }
     );
   }
-}
+}, 'strict');

package/dist/templates/app/api/superadmin/teams/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getTypedSession } from '@nextsparkjs/core/lib/auth';
 import { queryWithRLS } from '@nextsparkjs/core/lib/db';
 import { SYSTEM_ADMIN_TEAM_ID } from '@nextsparkjs/core/lib/api/auth/dual-auth';
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 interface TeamWithStats {
   id: string;
@@ -31,7 +32,7 @@ interface TeamWithStats {
  * - counts: Object with team counts
  * - pagination: Pagination info
  */
-export async function GET(request: NextRequest) {
+export const GET = withRateLimitTier(async (request: NextRequest) => {
   try {
     // Get the current session using Better Auth
     const session = await getTypedSession(request.headers);
@@ -183,4 +184,4 @@ export async function GET(request: NextRequest) {
       { status: 500 }
     );
   }
-}
+}, 'strict');

package/dist/templates/app/api/superadmin/users/[userId]/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { getTypedSession } from '@nextsparkjs/core/lib/auth';
 import { queryWithRLS } from '@nextsparkjs/core/lib/db';
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 interface UserResult {
   id: string;
@@ -46,7 +47,7 @@ interface RouteParams {
  * - teams: Array of team memberships
  * - stats: User statistics
  */
-export async function GET(request: NextRequest, { params }: RouteParams) {
+export const GET = withRateLimitTier(async (request: NextRequest, { params }: RouteParams) => {
   try {
     // Get the current session using Better Auth
     const session = await getTypedSession(request.headers);
@@ -212,7 +213,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
       { status: 500 }
     );
   }
-}
+}, 'strict');
 
 interface UserActionBody {
   action: 'change-role' | 'suspend' | 'unsuspend' | 'verify-email';
@@ -231,7 +232,7 @@ interface UserActionBody {
  * - unsuspend: Restore user's role to 'member'
  * - verify-email: Manually verify user's email
  */
-export async function PATCH(request: NextRequest, { params }: RouteParams) {
+export const PATCH = withRateLimitTier(async (request: NextRequest, { params }: RouteParams) => {
   try {
     // Get the current session using Better Auth
     const session = await getTypedSession(request.headers);
@@ -390,7 +391,7 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
       { status: 500 }
     );
   }
-}
+}, 'strict');
 
 /**
  * DELETE /api/superadmin/users/[userId]
@@ -403,7 +404,7 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
  * - Delete user's personal team
  * - Delete the user account
  */
-export async function DELETE(request: NextRequest, { params }: RouteParams) {
+export const DELETE = withRateLimitTier(async (request: NextRequest, { params }: RouteParams) => {
   try {
     // Get the current session using Better Auth
     const session = await getTypedSession(request.headers);
@@ -531,4 +532,4 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
       { status: 500 }
     );
   }
-}
+}, 'strict');