Arnas Donauskas 1d7829e68a fix(security): enforce agent role on service-role write routes (GHSA-34q7-fv77-625j) ... Flows and automations write routes verify only authentication/membership (via the RLS client, whose *_select policies have no minimum role) and then mutate with the service-role client, which bypasses the agent-gated *_insert/update/delete RLS policies. A read-only `viewer` therefore had full write power. H3 (High): add requireRole('agent') to the flows write handlers — PUT/DELETE (flows/[id]), activate (flows/[id]/activate), and create (flows POST). GET/list stay open to viewers. M2 (Medium): same gate on automations POST, the engine trigger (automations/engine, which sends outbound WhatsApp), and the [id] mutation handlers (PATCH/DELETE/duplicate). The cron route is unchanged — it is gated by the x-cron-secret shared secret, not user auth. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-07-08 09:35:20 +03:00
..
route.ts	fix(security): enforce agent role on service-role write routes (GHSA-34q7-fv77-625j)	2026-07-08 09:35:20 +03:00