security: re-secure fp-patch

pitch-deck/app/api/admin/fp-patch/route.ts

@@ -1,60 +1,17 @@
-import { NextResponse } from 'next/server'
+import { NextRequest, NextResponse } from 'next/server'
+import { requireAdmin } from '@/lib/admin-auth'
 import pool from '@/lib/db'
 import { computeFinanzplan } from '@/lib/finanzplan/engine'
 
-export async function POST() {
+/** Admin-only: recompute a Finanzplan scenario. */
-  const WD = 'c0000000-0000-0000-0000-000000000200'
+export async function POST(request: NextRequest) {
-  const results: string[] = []
+  const guard = await requireAdmin(request)
+  if (guard.kind === 'response') return guard.response
 
-  // 1. Stammkapital
+  const body = await request.json().catch(() => ({}))
-  const { rows: stk } = await pool.query(`SELECT id FROM fp_liquiditaet WHERE scenario_id=$1 AND row_label='Stammkapital'`, [WD])
+  const scenarioId = body.scenarioId || (await pool.query("SELECT id FROM fp_scenarios WHERE is_default = true LIMIT 1")).rows[0]?.id
-  if (stk.length === 0) {
+  if (!scenarioId) return NextResponse.json({ error: 'No scenario found' }, { status: 404 })
-    await pool.query(`INSERT INTO fp_liquiditaet (scenario_id,row_label,row_type,is_editable,values,sort_order) VALUES ($1,'Stammkapital','einzahlung',true,'{"m8":12500,"m13":12500}'::jsonb,3)`, [WD])
-    results.push('ADD Stammkapital')
-  }
 
-  // 2. Rename funding rows
+  const result = await computeFinanzplan(pool, scenarioId)
-  for (const [o,n] of [['Neuer Eigenkapitalzugang','Erhaltenes Wandeldarlehen Investor'],['Erhaltenes Fremdkapital','Erhaltenes Wandeldarlehen L-Bank']] as [string,string][]) {
+  return NextResponse.json({ success: true, scenarioId, cash_m60: result.liquiditaet?.endstand?.m60 })
-    const {rowCount}=await pool.query(`UPDATE fp_liquiditaet SET row_label=$1 WHERE scenario_id=$2 AND row_label=$3`,[n,WD,o])
-    if(rowCount&&rowCount>0) results.push(`RENAME ${o}`)
-  }
-  await pool.query(`UPDATE fp_liquiditaet SET row_label='Kreditrückzahlungen (Wandeldarlehen L-Bank)' WHERE scenario_id=$1 AND row_label='Kreditrückzahlungen'`,[WD])
-
-  // 3. Eigenkapital 2. Runde 500k Jan 2028
-  const { rows: ek2 } = await pool.query(`SELECT id FROM fp_liquiditaet WHERE scenario_id=$1 AND row_label='Eigenkapital (2. Finanzierungsrunde)'`, [WD])
-  if (ek2.length === 0) {
-    await pool.query(`INSERT INTO fp_liquiditaet (scenario_id,row_label,row_type,is_editable,values,sort_order) VALUES ($1,'Eigenkapital (2. Finanzierungsrunde)','einzahlung',true,'{"m25":500000}'::jsonb,6)`, [WD])
-    results.push('ADD EK 2. Runde 500k')
-  }
-
-  // 4. Kunden labels
-  await pool.query(`UPDATE fp_kunden SET row_label=row_label||' ('||segment_name||')' WHERE scenario_id=$1 AND row_label IN ('Neukunden','Churn','Bestandskunden') AND row_label NOT LIKE '%(%'`,[WD])
-
-  // 5. Clear materialaufwand
-  await pool.query(`UPDATE fp_materialaufwand SET values='{}' WHERE scenario_id=$1`,[WD])
-
-  // 6. Pos 3 start Oct 2026
-  await pool.query(`UPDATE fp_personalkosten SET start_date='2026-10-01' WHERE scenario_id=$1 AND position ILIKE '%Datenschutzjurist%'`,[WD])
-
-  // 7. Investments sync
-  await pool.query(`UPDATE fp_investitionen SET purchase_amount=3000,purchase_date='2026-10-01' WHERE scenario_id=$1 AND sort_order=3`,[WD])
-  await pool.query(`UPDATE fp_investitionen SET purchase_amount=6000,purchase_date='2028-04-01' WHERE scenario_id=$1 AND sort_order=4`,[WD])
-  for (const [so,dt] of [[5,'2028-09-01'],[6,'2029-04-01'],[7,'2029-09-01'],[8,'2030-01-01'],[9,'2030-06-01']] as [number,string][]) {
-    const {rows:ex}=await pool.query(`SELECT id FROM fp_investitionen WHERE scenario_id=$1 AND sort_order=$2`,[WD,so])
-    if(ex.length===0) await pool.query(`INSERT INTO fp_investitionen (scenario_id,item_name,category,purchase_amount,purchase_date,afa_years,is_editable,values_invest,values_afa,sort_order) VALUES ($1,'Ausstattung Arbeitsplatz','ausstattung',6000,$2,3,true,'{}','{}', $3)`,[WD,dt,so])
-  }
-
-  // 8. Fix GuV sort order + is_sum_row
-  await pool.query(`UPDATE fp_guv SET is_sum_row=false WHERE scenario_id=$1 AND row_label IN ('Umsatzerlöse','Bestandsveränderungen','Sonst. betriebl. Erträge','Materialaufwand Waren','Materialaufwand Leistungen','Löhne und Gehälter','Soziale Abgaben','Abschreibungen','Sonst. betriebl. Aufwendungen','Zinsertraege','Zinsaufwendungen','Körperschaftssteuer','Gewerbesteuer','Sonstige Steuern')`,[WD])
-  const sortFixes: [string,number][] = [['Materialaufwand Waren',4],['Materialaufwand Leistungen',5],['Summe Materialaufwand',6],['Rohergebnis',7],['Löhne und Gehälter',8],['Soziale Abgaben',9],['Summe Personalaufwand',10],['Abschreibungen',11],['Sonst. betriebl. Aufwendungen',12],['Sonst. betriebl. Erträge',13],['Summe sonst. Erträge',14],['EBIT',15]]
-  for (const [l,s] of sortFixes) await pool.query(`UPDATE fp_guv SET sort_order=$1 WHERE scenario_id=$2 AND row_label=$3`,[s,WD,l])
-
-  // 9. Fix umlaut: Zinsertraege
-  await pool.query(`UPDATE fp_guv SET row_label=REPLACE(row_label,'Zinsertraege','Zinserträge') WHERE row_label LIKE '%Zinsertraege%'`)
-
-  // 10. Recompute
-  const r = await computeFinanzplan(pool, WD)
-  results.push(`WD cash_m60=${r.liquiditaet?.endstand?.m60}`)
-
-  return NextResponse.json({ ok: true, results })
 }

pitch-deck/middleware.ts

@@ -6,7 +6,6 @@ const PUBLIC_PATHS = [
   '/auth',                    // investor login pages
   '/api/auth',                // investor auth API
   '/api/health',
-  '/api/admin/fp-patch',
   '/api/admin-auth',          // admin login API
   '/pitch-admin/login',       // admin login page
   '/_next',