From 86d729b837735fd3ad99196e8131f7670aa4f83c Mon Sep 17 00:00:00 2001
From: Benjamin Admin <benjaminadmin@MacBook-Pro.local>
Date: Wed, 22 Apr 2026 09:37:11 +0200
Subject: [PATCH] security: re-secure fp-patch

---
 pitch-deck/app/api/admin/fp-patch/route.ts | 49 +++++-----------------
 pitch-deck/middleware.ts                   |  1 -
 2 files changed, 11 insertions(+), 39 deletions(-)

diff --git a/pitch-deck/app/api/admin/fp-patch/route.ts b/pitch-deck/app/api/admin/fp-patch/route.ts
index 8018fac..ff87109 100644
--- a/pitch-deck/app/api/admin/fp-patch/route.ts
+++ b/pitch-deck/app/api/admin/fp-patch/route.ts
@@ -1,44 +1,17 @@
-import { NextResponse } from 'next/server'
+import { NextRequest, NextResponse } from 'next/server'
+import { requireAdmin } from '@/lib/admin-auth'
 import pool from '@/lib/db'
 import { computeFinanzplan } from '@/lib/finanzplan/engine'
 
-export async function POST() {
-  const WD = 'c0000000-0000-0000-0000-000000000200'
-  const results: string[] = []
+/** Admin-only: recompute a Finanzplan scenario. */
+export async function POST(request: NextRequest) {
+  const guard = await requireAdmin(request)
+  if (guard.kind === 'response') return guard.response
 
-  try {
-    // KFZ: rename + values
-    const leasing = Object.fromEntries(Array.from({length:36},(_,i)=>[`m${i+25}`,1050]))
-    await pool.query(`UPDATE fp_betriebliche_aufwendungen SET row_label='KFZ-Leasing (3 Fahrzeuge)', values=$1 WHERE scenario_id=$2 AND row_label IN ('Fahrzeugkosten','Fahrzeugkosten (F)')`, [JSON.stringify(leasing), WD])
+  const body = await request.json().catch(() => ({}))
+  const scenarioId = body.scenarioId || (await pool.query("SELECT id FROM fp_scenarios WHERE is_default = true LIMIT 1")).rows[0]?.id
+  if (!scenarioId) return NextResponse.json({ error: 'No scenario found' }, { status: 404 })
 
-    const fuel = Object.fromEntries(Array.from({length:36},(_,i)=>[`m${i+25}`,450]))
-    const {rows:ex} = await pool.query(`SELECT id FROM fp_betriebliche_aufwendungen WHERE scenario_id=$1 AND row_label='Kraftstoff / Ladestrom'`, [WD])
-    if (ex.length === 0) {
-      await pool.query(`INSERT INTO fp_betriebliche_aufwendungen (scenario_id,category,row_label,row_index,is_editable,is_sum_row,values,sort_order) VALUES ($1,'fahrzeug','Kraftstoff / Ladestrom',24,true,false,$2,24)`, [WD, JSON.stringify(fuel)])
-    }
-
-    const vers = Object.fromEntries(Array.from({length:36},(_,i)=>[`m${i+25}`,300]))
-    await pool.query(`UPDATE fp_betriebliche_aufwendungen SET values=$1 WHERE scenario_id=$2 AND row_label='KFZ-Versicherung'`, [JSON.stringify(vers), WD])
-
-    const steuern = Object.fromEntries(Array.from({length:36},(_,i)=>[`m${i+25}`,45]))
-    await pool.query(`UPDATE fp_betriebliche_aufwendungen SET values=$1 WHERE scenario_id=$2 AND row_label ILIKE 'KFZ-Steuern%'`, [JSON.stringify(steuern), WD])
-
-    // Move KFZ rows to fahrzeug category
-    await pool.query(`UPDATE fp_betriebliche_aufwendungen SET category='fahrzeug' WHERE scenario_id=$1 AND row_label IN ('KFZ-Versicherung','KFZ-Steuern','KFZ-Steuern (F)')`, [WD])
-
-    // Add fahrzeug header if missing
-    const {rows:hdr} = await pool.query(`SELECT id FROM fp_betriebliche_aufwendungen WHERE scenario_id=$1 AND category='fahrzeug' AND is_sum_row=true`, [WD])
-    if (hdr.length === 0) {
-      await pool.query(`INSERT INTO fp_betriebliche_aufwendungen (scenario_id,category,row_label,row_index,is_editable,is_sum_row,values,sort_order) VALUES ($1,'fahrzeug','Fahrzeugkosten',20,false,true,'{}',20)`, [WD])
-    }
-
-    results.push('KFZ updated')
-
-    const r = await computeFinanzplan(pool, WD)
-    results.push(`WD cash_m60=${r.liquiditaet?.endstand?.m60}`)
-  } catch (err) {
-    results.push(`ERROR: ${err instanceof Error ? err.message : String(err)}`)
-  }
-
-  return NextResponse.json({ ok: true, results })
+  const result = await computeFinanzplan(pool, scenarioId)
+  return NextResponse.json({ success: true, scenarioId, cash_m60: result.liquiditaet?.endstand?.m60 })
 }
diff --git a/pitch-deck/middleware.ts b/pitch-deck/middleware.ts
index fc6dfe4..2cfd3ba 100644
--- a/pitch-deck/middleware.ts
+++ b/pitch-deck/middleware.ts
@@ -6,7 +6,6 @@ const PUBLIC_PATHS = [
   '/auth',                    // investor login pages
   '/api/auth',                // investor auth API
   '/api/health',
-  '/api/admin/fp-patch',
   '/api/admin-auth',          // admin login API
   '/pitch-admin/login',       // admin login page
   '/_next',