mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 12:39:28 +00:00
Marius CiepluchandClaude Opus 5
c2d9c4ad01
Eight of the ten vendored access-control rows had no named handler at all, so every one of them would have scored `missing_context` forever rather than as a detector miss. After the re-harvest nine are named and the tenth states its reason. The handler-context mode now carries the class its framework registers, multi-line decorators, and commented-out guards -- `#@token_required` above a ThreatByte handler is the entire bug. Where the registration lives in another document (connexion's `operationId`, an express router), a recipe names `context = [...]`, the harvester writes that stanza per side, and the pair materializes both files at their repository-relative paths so the entry-point mapper sees the layout the project has. `harvest_recipe` fetches every blob before the first write and the driver takes `--report`, so a failed fetch leaves a reviewed excerpt exactly as it was. Two defects the re-harvest exposed: `.mjs` was not a known suffix, so the one pair vendored as an ES module had no file target at all; and `_python_route_access` matched auth words inside decorator prose, reading `@ns.doc(description='... without proper authorization checks')` as a guard. Recorded in the hygiene artifact: nine of the ten duplicate groups sit on both sides of the split, which the repository-level split cannot see. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
71 lines
2.4 KiB
TypeScript
71 lines
2.4 KiB
TypeScript
// Provenance: bigfivefoods/supplieradvisor-mvp PATCH (fixed).
|
|
// repo: bigfivefoods/supplieradvisor-mvp
|
|
// commit: 387bcf40e984a2ee1832ab7beabf0284c5b627d8
|
|
// parent: a7a9bc260d649ea2e582c07435bfd7d93100647b
|
|
// commit_url: https://github.com/bigfivefoods/supplieradvisor-mvp/commit/387bcf40e984a2ee1832ab7beabf0284c5b627d8
|
|
// cve:
|
|
// license: MIT
|
|
// function: PATCH
|
|
// relpath: app/api/customers/claims/route.ts
|
|
// provenance: agent
|
|
// mechanism: identity_from_request_body
|
|
// upstream_start: 90
|
|
|
|
export async function PATCH(request: NextRequest) {
|
|
try {
|
|
const body = await request.json();
|
|
const claimId = Number(body.id);
|
|
const companyId = Number(body.companyId);
|
|
if (!Number.isFinite(claimId) || claimId <= 0) {
|
|
return NextResponse.json({ error: 'id required' }, { status: 400 });
|
|
}
|
|
if (!Number.isFinite(companyId) || companyId <= 0) {
|
|
return NextResponse.json({ error: 'companyId required' }, { status: 400 });
|
|
}
|
|
|
|
const _gate = await requireCompanyAccess(request, companyId, { legacyPrivyUserId: legacyPrivyFrom(request) });
|
|
if (!_gate.ok) return _gate.response;
|
|
|
|
const supabase = getSupabaseServer();
|
|
const { data: existing, error: fetchError } = await supabase
|
|
.from('customer_claims')
|
|
.select('*')
|
|
.eq('id', claimId)
|
|
.eq('profile_id', companyId)
|
|
.single();
|
|
if (fetchError || !existing) {
|
|
return NextResponse.json({ error: 'Claim not found' }, { status: 404 });
|
|
}
|
|
|
|
const fields = [
|
|
'status',
|
|
'priority',
|
|
'title',
|
|
'description',
|
|
'amount_claimed',
|
|
'amount_approved',
|
|
'resolution_notes',
|
|
'owner_name',
|
|
'claim_type',
|
|
] as const;
|
|
const updates: Record<string, unknown> = { updated_at: new Date().toISOString() };
|
|
for (const f of fields) {
|
|
if (body[f] !== undefined) updates[f] = body[f];
|
|
}
|
|
if (['resolved', 'closed', 'approved', 'rejected'].includes(String(body.status))) {
|
|
updates.resolved_at = new Date().toISOString();
|
|
}
|
|
const { data, error } = await supabase
|
|
.from('customer_claims')
|
|
.update(updates)
|
|
.eq('id', claimId)
|
|
.eq('profile_id', companyId)
|
|
.select('*')
|
|
.single();
|
|
if (error) return NextResponse.json({ error: error.message }, { status: 500 });
|
|
return NextResponse.json({ success: true, claim: data });
|
|
} catch (e: unknown) {
|
|
return NextResponse.json({ error: e instanceof Error ? e.message : 'Error' }, { status: 500 });
|
|
}
|
|
}
|