881992b6cc
Pentest found that all 8 analytics API endpoints, the GeoIP status endpoint, and the OpenAPI spec were accessible to any authenticated user. Since the user role should only have access to forward auth and self-service, these are now admin-only. - analytics/*: requireUser → requireAdmin - geoip-status: requireUser → requireAdmin - openapi.json: add requireApiAdmin + change Cache-Control to private - analytics/api-docs pages: requireUser → requireAdmin (defense-in-depth) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
10 lines
286 B
TypeScript
10 lines
286 B
TypeScript
import { NextResponse } from 'next/server';
|
|
import { requireAdmin } from '@/src/lib/auth';
|
|
import { getAnalyticsHosts } from '@/src/lib/analytics-db';
|
|
|
|
export async function GET() {
|
|
await requireAdmin();
|
|
const hosts = await getAnalyticsHosts();
|
|
return NextResponse.json(hosts);
|
|
}
|