Security architecture upgrade + bug reporting system

Database & Security: - Dual password storage: bcrypt (auth) + pgcrypto AES-256 (recovery) - SUPER_ADMIN master key recovery system (master_keys table) - Row Level Security on customers, leads, opportunities, communications, tasks - SALES_USER: own records only - ADMIN: all records - SUPER_ADMIN: all records (bypasses RLS) - Immutable audit logs (DELETE/UPDATE blocked by triggers) - New audit event types: BUG_CREATED, BUG_UPDATED, BUG_ASSIGNED, BUG_RESOLVED, LOGIN, LOGOUT - Database export logging (database_export_logs table) - Backup logging with pg_dump script (scripts/backup.ps1) - Fixed audit constraint to allow new action types Authentication: - Random JWT secret generated on every dev server start (invalidates all prior sessions after restart) - Session cookie is now session-only (no maxAge) - setSessionContext() for RLS integration Bug Reporting System: - bug_reports table with RLS (insert by all, select/update by admin only) - POST /api/bug-reports (any authenticated user) - GET /api/bug-reports (admin/super_admin only) - PATCH /api/bug-reports/:id (admin/super_admin only) - POST /api/auth/recover (super_admin password recovery) - Audit logging for all bug report actions Other: - Added 'dev' to UserRole type - Bug report modal UI with severity selector - Added bug report button to topbar
2026-06-26 11:13:28 +02:00
parent 9bbaf70145
commit 20a1744e7f
13 changed files with 1365 additions and 5 deletions
@@ -0,0 +1,69 @@
+import { NextRequest, NextResponse } from "next/server"
+import { query } from "@/lib/db"
+import { getSessionUser, setSessionContext } from "@/lib/auth"
+
+export async function PATCH(request: NextRequest, { params: routeParams }: { params: Promise<{ id: string }> }) {
+  try {
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) {
+      return NextResponse.json({ error: "Not authenticated." }, { status: 401 })
+    }
+    if (sessionUser.role !== "admin" && sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden. Only admins can update bug reports." }, { status: 403 })
+    }
+
+    const { id } = await routeParams
+    const { status, assigned_to, resolution_notes } = await request.json()
+
+    const ipAddress =
+      request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
+      request.headers.get("x-real-ip") ||
+      "127.0.0.1"
+
+    await setSessionContext(sessionUser.id, ipAddress)
+
+    const validStatuses = ["open", "in_progress", "resolved", "closed"]
+    if (status && !validStatuses.includes(status)) {
+      return NextResponse.json({ error: "Invalid status." }, { status: 400 })
+    }
+
+    const existing = await query("SELECT id, status FROM bug_reports WHERE id = $1", [id])
+    if (existing.rows.length === 0) {
+      return NextResponse.json({ error: "Bug report not found." }, { status: 404 })
+    }
+
+    const updates: string[] = []
+    const values: unknown[] = []
+    let paramIndex = 1
+
+    if (status !== undefined) {
+      updates.push(`status = $${paramIndex++}`)
+      values.push(status)
+    }
+    if (assigned_to !== undefined) {
+      updates.push(`assigned_to = $${paramIndex++}`)
+      values.push(assigned_to === "null" ? null : assigned_to)
+    }
+    if (resolution_notes !== undefined) {
+      updates.push(`resolution_notes = $${paramIndex++}`)
+      values.push(resolution_notes)
+    }
+
+    if (updates.length === 0) {
+      return NextResponse.json({ error: "No fields to update." }, { status: 400 })
+    }
+
+    updates.push(`updated_at = NOW()`)
+    values.push(id)
+
+    await query(
+      `UPDATE bug_reports SET ${updates.join(", ")} WHERE id = $${paramIndex}`,
+      values
+    )
+
+    return NextResponse.json({ success: true }, { status: 200 })
+  } catch (error) {
+    console.error("Error updating bug report:", error)
+    return NextResponse.json({ error: "Failed to update bug report." }, { status: 500 })
+  }
+}