Aatvi AI: Vom KI-Prototyp bis zum Altsystem braucht Software fundierte Entwicklungsarbeit.

1 // app/api/workspaces/[id]/invoices/route.ts2 export async function GET(req: NextRequest, { params }: RouteContext) {3   const { id: workspaceId } = await params;4 5entfernt: -  // FLAW: Service-role key bypasses RLS and trusts route param6entfernt: -  const supabase = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_SERVICE_ROLE_KEY!);7entfernt: -  const { data: invoices } = await supabase.from("invoices").select("*")8entfernt: -    .eq("workspace_id", workspaceId);9   return NextResponse.json({ invoices });10 }

1 // app/api/workspaces/[id]/invoices/route.ts2 export async function GET(req: NextRequest, { params }: RouteContext) {3   const { id: workspaceId } = await params;4hinzugefügt: +  const supabase = createServerClient(req);5hinzugefügt: +  const { data: { user } } = await supabase.auth.getUser();6hinzugefügt: +  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });7hinzugefügt: +  // HARDENED: Verify membership in workspace before query8hinzugefügt: +  const { data: member } = await supabase.from("workspace_members")9hinzugefügt: +    .select("role").eq("workspace_id", workspaceId).eq("user_id", user.id).single();10hinzugefügt: +  if (!member) return NextResponse.json({ error: "Not Found" }, { status: 404 });11hinzugefügt: +  const { data: invoices } = await supabase.from("invoices").select("id, amount, status")12hinzugefügt: +    .eq("workspace_id", workspaceId);13   return NextResponse.json({ invoices });14 }