security: re-secure fp-patch

pitch-deck/app/api/admin/fp-patch/route.ts

@@ -1,74 +1,17 @@
-import { NextResponse } from 'next/server'
+import { NextRequest, NextResponse } from 'next/server'
+import { requireAdmin } from '@/lib/admin-auth'
 import pool from '@/lib/db'
 import { computeFinanzplan } from '@/lib/finanzplan/engine'
 
-export async function POST() {
+/** Admin-only: recompute a Finanzplan scenario. */
-  const results: string[] = []
+export async function POST(request: NextRequest) {
-  const BASE = (await pool.query("SELECT id FROM fp_scenarios WHERE is_default=true LIMIT 1")).rows[0]?.id
+  const guard = await requireAdmin(request)
-  const WD = 'c0000000-0000-0000-0000-000000000200'
+  if (guard.kind === 'response') return guard.response
 
-  for (const [sid, label] of [[BASE, 'BASE'], [WD, 'WD']] as [string, string][]) {
+  const body = await request.json().catch(() => ({}))
-    if (!sid) continue
+  const scenarioId = body.scenarioId || (await pool.query("SELECT id FROM fp_scenarios WHERE is_default = true LIMIT 1")).rows[0]?.id
+  if (!scenarioId) return NextResponse.json({ error: 'No scenario found' }, { status: 404 })
 
-    // 1. Reduce Investitionen: Laptop only (1500/person)
+  const result = await computeFinanzplan(pool, scenarioId)
-    // Gründer: 2 × 1500 = 3000 (was 12000)
+  return NextResponse.json({ success: true, scenarioId, cash_m60: result.liquiditaet?.endstand?.m60 })
-    await pool.query(`UPDATE fp_investitionen SET purchase_amount=3000 WHERE scenario_id=$1 AND item_name ILIKE '%Gründer%' AND purchase_amount=12000`, [sid])
-
-    if (label === 'WD') {
-      // WD: individual positions at 1500 each (was 3000-6000)
-      await pool.query(`UPDATE fp_investitionen SET purchase_amount=1500 WHERE scenario_id=$1 AND item_name='Ausstattung Arbeitsplatz' AND purchase_amount IN (3000, 6000)`, [sid])
-    } else {
-      // BASE 1M: grouped positions, scale down by ratio (laptop = 1500, was 6000 per person)
-      // Pos 3-5: 3 people × 1500 = 4500 (was 18000)
-      await pool.query(`UPDATE fp_investitionen SET purchase_amount=4500 WHERE scenario_id=$1 AND item_name ILIKE '%Pos 3-5%'`, [sid])
-      // Pos 6-10: 5 people × 1500 = 7500 (was 30000)
-      await pool.query(`UPDATE fp_investitionen SET purchase_amount=7500 WHERE scenario_id=$1 AND item_name ILIKE '%Pos 6-10%'`, [sid])
-      // Pos 11-17: 7 people × 1500 = 10500 (was 42000)
-      await pool.query(`UPDATE fp_investitionen SET purchase_amount=10500 WHERE scenario_id=$1 AND item_name ILIKE '%Pos 11-17%'`, [sid])
-      // Pos 18-25: 8 people × 1500 = 12000 (was 48000)
-      await pool.query(`UPDATE fp_investitionen SET purchase_amount=12000 WHERE scenario_id=$1 AND item_name ILIKE '%Pos 18-25%'`, [sid])
-      // Pos 26-35: 10 people × 1500 = 15000 (was 60000)
-      await pool.query(`UPDATE fp_investitionen SET purchase_amount=15000 WHERE scenario_id=$1 AND item_name ILIKE '%Pos 26-35%'`, [sid])
-    }
-    results.push(`${label}: invest reduced to laptop-only`)
-
-    // 2. Set GWG values (peripherals ~1000/new MA + ~200/MA/year ongoing)
-    const gwgRow = await pool.query(`SELECT id FROM fp_investitionen WHERE scenario_id=$1 AND item_name ILIKE '%GWG%'`, [sid])
-    if (gwgRow.rows.length > 0) {
-      let gwg: Record<string, number> = {}
-      if (label === 'WD') {
-        // WD: 9 MA total
-        // 2026 m8-m12: 3 new MA × 1000 + 100 ongoing = 3100, spread monthly
-        for (let m = 8; m <= 12; m++) gwg[`m${m}`] = 620
-        // 2027: 0 new + 3 MA × 200/12 = 50/month
-        for (let m = 13; m <= 24; m++) gwg[`m${m}`] = 50
-        // 2028: 2 new × 1000 spread + 5 MA × 200/12
-        for (let m = 25; m <= 36; m++) gwg[`m${m}`] = 250
-        // 2029: 2 new × 1000 spread + 7 MA × 200/12
-        for (let m = 37; m <= 48; m++) gwg[`m${m}`] = 280
-        // 2030: 2 new × 1000 spread + 9 MA × 200/12
-        for (let m = 49; m <= 60; m++) gwg[`m${m}`] = 320
-      } else {
-        // BASE 1M: 35 MA total
-        // 2026: 5 new × 1000 + ongoing = ~5500, spread
-        for (let m = 8; m <= 12; m++) gwg[`m${m}`] = 600
-        // 2027: 5 new × 1000 + 10 × 200/12
-        for (let m = 13; m <= 24; m++) gwg[`m${m}`] = 580
-        // 2028: 7 new × 1000 + 17 × 200/12
-        for (let m = 25; m <= 36; m++) gwg[`m${m}`] = 870
-        // 2029: 8 new × 1000 + 25 × 200/12
-        for (let m = 37; m <= 48; m++) gwg[`m${m}`] = 1080
-        // 2030: 10 new × 1000 + 35 × 200/12
-        for (let m = 49; m <= 60; m++) gwg[`m${m}`] = 1420
-      }
-      await pool.query(`UPDATE fp_investitionen SET purchase_amount=0, values_invest=$1 WHERE id=$2`, [JSON.stringify(gwg), gwgRow.rows[0].id])
-      results.push(`${label}: GWG filled`)
-    }
-
-    // 3. Recompute
-    const r = await computeFinanzplan(pool, sid)
-    results.push(`${label}: cash_m60=${r.liquiditaet?.endstand?.m60}`)
-  }
-
-  return NextResponse.json({ ok: true, results })
 }

pitch-deck/middleware.ts

@@ -6,7 +6,6 @@ const PUBLIC_PATHS = [
   '/auth',                    // investor login pages
   '/api/auth',                // investor auth API
   '/api/health',
-  '/api/admin/fp-patch',
   '/api/admin-auth',          // admin login API
   '/pitch-admin/login',       // admin login page
   '/_next',