security(pitch-deck): re-secure fp-patch, convert to admin recompute endpoint

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pitch-deck/app/api/admin/fp-patch/route.ts

@@ -1,43 +1,27 @@
 import { NextRequest, NextResponse } from 'next/server'
+import { requireAdmin } from '@/lib/admin-auth'
 import pool from '@/lib/db'
 import { computeFinanzplan } from '@/lib/finanzplan/engine'
 
 /**
- * TEMPORARY public patch: fix WD funding + recompute.
+ * Admin-only patch endpoint for Finanzplan recompute.
- * POST /api/admin/fp-patch
+ * POST /api/admin/fp-patch  { scenarioId?: string }
  */
-export async function POST() {
+export async function POST(request: NextRequest) {
-  const results: string[] = []
+  const guard = await requireAdmin(request)
+  if (guard.kind === 'response') return guard.response
 
-  try {
+  const body = await request.json().catch(() => ({}))
-    // 1. Fix WD Eigenkapital = 40k in m8
+  const scenarioId = body.scenarioId || (await pool.query("SELECT id FROM fp_scenarios WHERE is_default = true LIMIT 1")).rows[0]?.id
-    await pool.query(`
-      UPDATE fp_liquiditaet
-      SET values = jsonb_set(values, '{m8}', '40000')
-      WHERE scenario_id = 'c0000000-0000-0000-0000-000000000200'
-      AND row_label = 'Neuer Eigenkapitalzugang'
-    `)
-    results.push('SET WD Eigenkapital m8=40000')
 
-    // 2. Fix WD Fremdkapital = 160k in m8
+  if (!scenarioId) {
-    await pool.query(`
+    return NextResponse.json({ error: 'No scenario found' }, { status: 404 })
-      UPDATE fp_liquiditaet
-      SET values = jsonb_set(values, '{m8}', '160000')
-      WHERE scenario_id = 'c0000000-0000-0000-0000-000000000200'
-      AND row_label = 'Erhaltenes Fremdkapital'
-    `)
-    results.push('SET WD Fremdkapital m8=160000')
-
-    // 3. Recompute WD scenario
-    const result = await computeFinanzplan(pool, 'c0000000-0000-0000-0000-000000000200')
-    results.push(`COMPUTED WD: cash_m60=${result.liquiditaet?.endstand?.m60}`)
-
-    // 4. Also recompute Base Case
-    const resultBase = await computeFinanzplan(pool, (await pool.query("SELECT id FROM fp_scenarios WHERE is_default = true LIMIT 1")).rows[0].id)
-    results.push(`COMPUTED BASE: cash_m60=${resultBase.liquiditaet?.endstand?.m60}`)
-  } catch (err) {
-    results.push(`ERROR: ${err instanceof Error ? err.message : String(err)}`)
   }
 
-  return NextResponse.json({ success: true, results })
+  const result = await computeFinanzplan(pool, scenarioId)
+  return NextResponse.json({
+    success: true,
+    scenarioId,
+    cash_m60: result.liquiditaet?.endstand?.m60,
+  })
 }

pitch-deck/middleware.ts

@@ -6,7 +6,6 @@ const PUBLIC_PATHS = [
   '/auth',                    // investor login pages
   '/api/auth',                // investor auth API
   '/api/health',
-  '/api/admin/fp-patch',        // TEMP: will be removed after execution
   '/api/admin-auth',          // admin login API
   '/pitch-admin/login',       // admin login page
   '/_next',