From ed4e41f7dc8c828f4794e49822008f4c5db955b1 Mon Sep 17 00:00:00 2001
From: Benjamin Admin <benjaminadmin@MacBook-Pro.local>
Date: Thu, 23 Apr 2026 09:56:28 +0200
Subject: [PATCH] =?UTF-8?q?security:=20re-secure=20fp-patch=20=E2=80=94=20?=
 =?UTF-8?q?1M=20liquidity=20Dec28=20at=20~0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pitch-deck/app/api/admin/fp-patch/route.ts | 26 +++++++++-------------
 pitch-deck/middleware.ts                   |  1 -
 2 files changed, 11 insertions(+), 16 deletions(-)

diff --git a/pitch-deck/app/api/admin/fp-patch/route.ts b/pitch-deck/app/api/admin/fp-patch/route.ts
index 0464ba5..ff87109 100644
--- a/pitch-deck/app/api/admin/fp-patch/route.ts
+++ b/pitch-deck/app/api/admin/fp-patch/route.ts
@@ -1,21 +1,17 @@
-import { NextResponse } from 'next/server'
+import { NextRequest, NextResponse } from 'next/server'
+import { requireAdmin } from '@/lib/admin-auth'
 import pool from '@/lib/db'
 import { computeFinanzplan } from '@/lib/finanzplan/engine'
 
-export async function POST() {
-  const BASE = (await pool.query("SELECT id FROM fp_scenarios WHERE is_default=true LIMIT 1")).rows[0]?.id
+/** Admin-only: recompute a Finanzplan scenario. */
+export async function POST(request: NextRequest) {
+  const guard = await requireAdmin(request)
+  if (guard.kind === 'response') return guard.response
 
-  const agentur: Record<string,number> = {}
-  for (let m = 8; m <= 12; m++) agentur[`m${m}`] = 5000
-  for (let m = 13; m <= 24; m++) agentur[`m${m}`] = 12000
-  for (let m = 25; m <= 36; m++) agentur[`m${m}`] = 35000
-  for (let m = 37; m <= 48; m++) agentur[`m${m}`] = 20000
-  for (let m = 49; m <= 60; m++) agentur[`m${m}`] = 25000
+  const body = await request.json().catch(() => ({}))
+  const scenarioId = body.scenarioId || (await pool.query("SELECT id FROM fp_scenarios WHERE is_default = true LIMIT 1")).rows[0]?.id
+  if (!scenarioId) return NextResponse.json({ error: 'No scenario found' }, { status: 404 })
 
-  await pool.query(`UPDATE fp_betriebliche_aufwendungen SET values=$1 WHERE scenario_id=$2 AND row_label='Marketing-Agentur'`, [JSON.stringify(agentur), BASE])
-
-  const r = await computeFinanzplan(pool, BASE)
-  const { rows: liq } = await pool.query(`SELECT (values->>'m24')::numeric as dec27, (values->>'m36')::numeric as dec28, (values->>'m60')::numeric as dec30 FROM fp_liquiditaet WHERE scenario_id=$1 AND row_label='LIQUIDITÄT'`, [BASE])
-
-  return NextResponse.json({ ok: true, dec27: liq[0]?.dec27, dec28: liq[0]?.dec28, dec30: liq[0]?.dec30 })
+  const result = await computeFinanzplan(pool, scenarioId)
+  return NextResponse.json({ success: true, scenarioId, cash_m60: result.liquiditaet?.endstand?.m60 })
 }
diff --git a/pitch-deck/middleware.ts b/pitch-deck/middleware.ts
index fc6dfe4..2cfd3ba 100644
--- a/pitch-deck/middleware.ts
+++ b/pitch-deck/middleware.ts
@@ -6,7 +6,6 @@ const PUBLIC_PATHS = [
   '/auth',                    // investor login pages
   '/api/auth',                // investor auth API
   '/api/health',
-  '/api/admin/fp-patch',
   '/api/admin-auth',          // admin login API
   '/pitch-admin/login',       // admin login page
   '/_next',