Mattsson
e11f70b347
* refactor: optimize page loading and data fetching * fix: resolve recurring production runtime errors * feat: add MCP company and customer updates * fix: handle year-end tax adjustments * feat: harden annual report compliance * fix: expand invoice logo and font support * fix: sanitize API route error responses * fix: sanitize user-facing error messages * feat: persist onboarding and tax assessment notices * fix: reduce cloud backup audit churn * feat: refine invoice editor layout * fix: show saved tax adjustments in INK2 * fix: complete annual report API mappings * docs: record operational safeguards and decisions * fix: harden annual report review findings * fix: adjust column span for description based on VAT registration * New css class name
91 lines
3.0 KiB
TypeScript
91 lines
3.0 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import { withRouteContext } from '@/lib/api/with-route-context'
|
|
import { z } from 'zod'
|
|
import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'
|
|
|
|
/**
|
|
* GET /api/settings/oauth-clients: list the current user's registered
|
|
* redirect URIs.
|
|
* POST /api/settings/oauth-clients: register a new redirect URI for use
|
|
* with the MCP OAuth flow.
|
|
*
|
|
* Built-in patterns (claude.ai, claude.com, localhost) bypass this table
|
|
* entirely: registrations here are only for self-hosted custom apps.
|
|
*/
|
|
|
|
const RegistrationSchema = z.object({
|
|
client_name: z.string().trim().min(1).max(100),
|
|
// Reject loopback first (covers http:// too) so the user gets the helpful
|
|
// "already allowed" message instead of being told to use https for localhost.
|
|
// Non-loopback URIs must use https.
|
|
redirect_uri: z
|
|
.string()
|
|
.url('redirect_uri must be a valid URL')
|
|
.refine(
|
|
(u) => !/^https?:\/\/(localhost|127\.0\.0\.1|\[::1\]|::1)(:|\/|$)/i.test(u),
|
|
'localhost är redan tillåtet utan registrering'
|
|
)
|
|
.refine((u) => u.startsWith('https://'), 'redirect_uri måste använda https://')
|
|
.max(500),
|
|
})
|
|
|
|
export const GET = withRouteContext(
|
|
'oauth_client.list',
|
|
async (_request, { supabase, user }) => {
|
|
const { data, error } = await supabase
|
|
.from('oauth_client_registrations')
|
|
.select('id, client_name, redirect_uri, created_at, revoked_at')
|
|
.eq('user_id', user.id)
|
|
.order('created_at', { ascending: false })
|
|
|
|
if (error) {
|
|
return NextResponse.json({ error: getUserErrorMessage(error) }, { status: 500 })
|
|
}
|
|
|
|
return NextResponse.json({ data })
|
|
},
|
|
)
|
|
|
|
export const POST = withRouteContext(
|
|
'oauth_client.create',
|
|
async (request, { supabase, user }) => {
|
|
let body: z.infer<typeof RegistrationSchema>
|
|
try {
|
|
const json = await request.json()
|
|
body = RegistrationSchema.parse(json)
|
|
} catch (err) {
|
|
const message =
|
|
err instanceof z.ZodError
|
|
? err.issues[0]?.message ?? 'Ogiltig redirect URI'
|
|
: err instanceof SyntaxError
|
|
? 'Ogiltig JSON i request body'
|
|
: 'Ogiltig redirect URI'
|
|
return NextResponse.json({ error: message }, { status: 400 })
|
|
}
|
|
|
|
const { data, error } = await supabase
|
|
.from('oauth_client_registrations')
|
|
.insert({
|
|
user_id: user.id,
|
|
client_name: body.client_name,
|
|
redirect_uri: body.redirect_uri,
|
|
})
|
|
.select('id, client_name, redirect_uri, created_at')
|
|
.single()
|
|
|
|
if (error) {
|
|
// Unique-index violation on redirect_uri → 409
|
|
if (error.code === '23505') {
|
|
return NextResponse.json(
|
|
{ error: 'Den här redirect URI:n är redan registrerad.' },
|
|
{ status: 409 }
|
|
)
|
|
}
|
|
return NextResponse.json({ error: getUserErrorMessage(error) }, { status: 500 })
|
|
}
|
|
|
|
return NextResponse.json({ data })
|
|
},
|
|
{ requireWrite: true },
|
|
)
|