Leon SerfatyandClaude Opus 4.8
c9968531e4
Batch commit of the pending working tree on security/audit-fixes-2026-07. Major areas: - Outbound webhooks / Zapier: schema + signed delivery with retries, public v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain. - Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when Spaces is unconfigured instead of silently using ephemeral disk. - Integrations & features (concurrent work): accounting (QuickBooks/Xero), e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding, expanded legal pages. - DB migrations 0006–0009. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
34 lines
1.2 KiB
TypeScript
34 lines
1.2 KiB
TypeScript
import { NextResponse } from "next/server"
|
|
import { getSessionUser } from "@/lib/session"
|
|
import { getAccountContext } from "@/lib/account"
|
|
import { getProvider } from "@/lib/accounting"
|
|
import { signState } from "@/lib/accounting/state"
|
|
|
|
// Starts the OAuth connect flow for an accounting provider (owner-only).
|
|
export async function GET(request: Request, { params }: { params: Promise<{ provider: string }> }) {
|
|
const { provider: pid } = await params
|
|
const prov = getProvider(pid)
|
|
const settings = new URL("/settings/integrations", request.url)
|
|
|
|
if (!prov) {
|
|
settings.searchParams.set("error", "unknown_provider")
|
|
return NextResponse.redirect(settings)
|
|
}
|
|
|
|
const user = await getSessionUser()
|
|
if (!user) return NextResponse.redirect(new URL("/login", request.url))
|
|
|
|
const ctx = await getAccountContext(user.id)
|
|
if (!ctx.isOwner) {
|
|
settings.searchParams.set("error", "owner_only")
|
|
return NextResponse.redirect(settings)
|
|
}
|
|
if (!prov.configured()) {
|
|
settings.searchParams.set("error", "not_configured")
|
|
return NextResponse.redirect(settings)
|
|
}
|
|
|
|
const state = signState({ ownerId: ctx.ownerId, provider: pid })
|
|
return NextResponse.redirect(prov.getAuthUrl(state))
|
|
}
|