security: re-secure fp-patch

pitch-deck/app/api/admin/fp-patch/route.ts

@@ -1,54 +1,17 @@
-import { NextResponse } from 'next/server'
+import { NextRequest, NextResponse } from 'next/server'
+import { requireAdmin } from '@/lib/admin-auth'
 import pool from '@/lib/db'
 import { computeFinanzplan } from '@/lib/finanzplan/engine'
 
-export async function POST() {
+/** Admin-only: recompute a Finanzplan scenario. */
-  const WD = 'c0000000-0000-0000-0000-000000000200'
+export async function POST(request: NextRequest) {
-  const results: string[] = []
+  const guard = await requireAdmin(request)
+  if (guard.kind === 'response') return guard.response
 
-  try {
+  const body = await request.json().catch(() => ({}))
-    // 1. Delete old materialaufwand
+  const scenarioId = body.scenarioId || (await pool.query("SELECT id FROM fp_scenarios WHERE is_default = true LIMIT 1")).rows[0]?.id
-    await pool.query(`DELETE FROM fp_materialaufwand WHERE scenario_id=$1`, [WD])
+  if (!scenarioId) return NextResponse.json({ error: 'No scenario found' }, { status: 404 })
 
-    // 2. Get Serverkosten values from betriebliche (if still there)
+  const result = await computeFinanzplan(pool, scenarioId)
-    const { rows: srv } = await pool.query(`SELECT values FROM fp_betriebliche_aufwendungen WHERE scenario_id=$1 AND (row_label LIKE '%Serverkosten%')`, [WD])
+  return NextResponse.json({ success: true, scenarioId, cash_m60: result.liquiditaet?.endstand?.m60 })
-    const srvVals = srv[0]?.values || {}
-
-    // 3. Get KI Tools values
-    const { rows: ki } = await pool.query(`SELECT values FROM fp_betriebliche_aufwendungen WHERE scenario_id=$1 AND row_label='KI Tools'`, [WD])
-    const kiVals = ki[0]?.values || {}
-
-    // 4. Delete moved rows from betriebliche
-    await pool.query(`DELETE FROM fp_betriebliche_aufwendungen WHERE scenario_id=$1 AND row_label IN ('Serverkosten (Cloud)','Serverkosten Cloud (F)','Mietkosten Software','KI Tools')`, [WD])
-    results.push('Deleted from betriebliche')
-
-    // 5. Insert new materialaufwand structure
-    const inserts: [string, number, Record<string,unknown>][] = [
-      ['Cloud-Hosting (SysEleven/Hetzner)', 1, srvVals],
-      ['3rd Party API', 2, {}],
-      ['LLM-Inferenzkosten (KI Tools)', 3, kiVals],
-      ['Datenbank-Hosting (PostgreSQL/Qdrant)', 4, {}],
-      ['CDN / Storage (S3/MinIO)', 5, {}],
-      ['SUMME', 99, {}],
-    ]
-    for (const [label, sort, vals] of inserts) {
-      await pool.query(
-        `INSERT INTO fp_materialaufwand (scenario_id,section,row_label,row_index,is_editable,values,sort_order) VALUES ($1,'cost',$2,$3,$4,$5,$3)`,
-        [WD, label, sort, label !== 'SUMME', JSON.stringify(vals)]
-      )
-    }
-    results.push(`Inserted ${inserts.length} materialaufwand rows`)
-
-    // 6. Recompute
-    const r = await computeFinanzplan(pool, WD)
-    results.push(`WD cash_m60=${r.liquiditaet?.endstand?.m60}`)
-
-    // 7. Check gross margin
-    const { rows: guv } = await pool.query(`SELECT (values->>'y2026')::numeric as y26, (values->>'y2030')::numeric as y30 FROM fp_guv WHERE scenario_id=$1 AND row_label='Summe Materialaufwand'`, [WD])
-    results.push(`Material: ${JSON.stringify(guv[0])}`)
-  } catch (err) {
-    results.push(`ERROR: ${err instanceof Error ? err.message : String(err)}`)
-  }
-
-  return NextResponse.json({ ok: true, results })
 }

pitch-deck/middleware.ts

@@ -6,7 +6,6 @@ const PUBLIC_PATHS = [
   '/auth',                    // investor login pages
   '/api/auth',                // investor auth API
   '/api/health',
-  '/api/admin/fp-patch',
   '/api/admin-auth',          // admin login API
   '/pitch-admin/login',       // admin login page
   '/_next',