Benjamin_Boenisch/breakpilot-core
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

security: re-secure fp-patch after 1M data import
All checks were successful
Build pitch-deck / build-push-deploy (push) Successful in 1m7s
Details
CI / go-lint (push) Has been skipped
Details
CI / python-lint (push) Has been skipped
Details
CI / nodejs-lint (push) Has been skipped
Details
CI / test-go-consent (push) Successful in 33s
Details
CI / test-python-voice (push) Successful in 28s
Details
CI / test-bqas (push) Successful in 25s
Details

Browse Source
This commit is contained in:
Benjamin Admin
2026-04-22 22:42:07 +02:00
parent 0992c73842
commit 43c4c5102a
2 changed files with 9 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
pitch-deck/app/api/admin/fp-patch/route.ts
View File

@@ -1,44 +1,17 @@
import { NextRequest, NextResponse } from 'next/server'
import { requireAdmin } from '@/lib/admin-auth'
import pool from '@/lib/db'
import { computeFinanzplan } from '@/lib/finanzplan/engine'
/** Admin-only: recompute a Finanzplan scenario. */
export async function POST(request: NextRequest) {
const guard = await requireAdmin(request)
if (guard.kind === 'response') return guard.response
const body = await request.json().catch(() => ({}))
const results: string[] = []
const scenarioId = body.scenarioId || (await pool.query("SELECT id FROM fp_scenarios WHERE is_default = true LIMIT 1")).rows[0]?.id
if (!scenarioId) return NextResponse.json({ error: 'No scenario found' }, { status: 404 })
try {
const BASE = (await pool.query("SELECT id FROM fp_scenarios WHERE is_default=true LIMIT 1")).rows[0]?.id
if (!BASE) return NextResponse.json({ ok: false, error: 'No base scenario' })
// Import betriebliche
if (body.betriebliche?.length) {
await pool.query(`DELETE FROM fp_betriebliche_aufwendungen WHERE scenario_id=$1`, [BASE])
for (const r of body.betriebliche) {
await pool.query(
`INSERT INTO fp_betriebliche_aufwendungen (scenario_id,category,row_label,row_index,is_editable,is_sum_row,formula_desc,values,sort_order) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)`,
[BASE, r.category, r.row_label, r.row_index, r.is_editable, r.is_sum_row, r.formula_desc, JSON.stringify(r.values), r.sort_order])
}
results.push(`betriebliche: ${body.betriebliche.length}`)
}
// Fix founders start_date if needed (should be Oct 2026)
const { rowCount: f1 } = await pool.query(
`UPDATE fp_personalkosten SET start_date='2026-10-01' WHERE scenario_id=$1 AND person_name ILIKE '%Benjamin%' AND (start_date IS NULL OR start_date > '2026-10-01')`, [BASE])
const { rowCount: f2 } = await pool.query(
`UPDATE fp_personalkosten SET start_date='2026-10-01' WHERE scenario_id=$1 AND person_name ILIKE '%Sharang%' AND (start_date IS NULL OR start_date > '2026-10-01')`, [BASE])
if (f1 || f2) results.push(`Founders start fixed: B=${f1} S=${f2}`)
// Recompute
const r = await computeFinanzplan(pool, BASE)
results.push(`BASE cash_m60=${r.liquiditaet?.endstand?.m60}`)
// Verify founders
const { rows: check } = await pool.query(
`SELECT person_name, start_date, brutto_monthly, (values_total->>'m10')::numeric as okt26 FROM fp_personalkosten WHERE scenario_id=$1 AND sort_order <= 2 ORDER BY sort_order`, [BASE])
results.push(`Founders: ${JSON.stringify(check)}`)
} catch (err) {
results.push(`ERROR: ${err instanceof Error ? err.message : String(err)}`)
}
return NextResponse.json({ ok: true, results })
const result = await computeFinanzplan(pool, scenarioId)
return NextResponse.json({ success: true, scenarioId, cash_m60: result.liquiditaet?.endstand?.m60 })
}