Security: Prevent cross-tenant data exposure and credentialed public …

Realism/app/api/live/data/[userId]/[slug]/route.ts

@@ -1,46 +1,72 @@
-import { NextRequest, NextResponse } from 'next/server'
-import { getDataPlan, getCachedData, setCachedData } from '@/lib/live-apps'
-import { executeAllFetches } from '@/lib/live-data-executor'
-
-export async function GET(
-  req: NextRequest,
-  { params }: { params: Promise<{ userId: string; slug: string }> }
-) {
-  const { userId, slug } = await params
-
-  if (!userId || !slug) {
-    return NextResponse.json({ error: 'Invalid path' }, { status: 400 })
-  }
-
-  const plan = await getDataPlan(userId, slug)
-  if (!plan) {
-    return NextResponse.json(
-      { error: 'App not found or data plan missing' },
-      { status: 404 }
-    )
-  }
-
-  const cached = await getCachedData(userId, slug)
-  if (cached) {
-    return NextResponse.json(
-      { ...cached, cached: true },
-      {
-        headers: {
-          'Cache-Control': 'no-store',
-          'Access-Control-Allow-Origin': '*',
-        },
-      }
-    )
-  }
-
-  const result = await executeAllFetches(plan)
-
-  await setCachedData(userId, slug, result, plan.cacheTTL)
-
-  return NextResponse.json(result, {
-    headers: {
-      'Cache-Control': 'no-store',
-      'Access-Control-Allow-Origin': '*',
-    },
-  })
-}
+import { NextRequest, NextResponse } from 'next/server'
+import { getDataPlan, getCachedData, setCachedData } from '@/lib/live-apps'
+import { executeAllFetches } from '@/lib/live-data-executor'
+import { validateSession } from '@/lib/auth' // Imported for session validation
+
+// Define an allowlist for permitted origins (CORS restriction)
+const ALLOWED_ORIGINS = [
+  process.env.NEXT_PUBLIC_APP_URL, // e.g., 'https://yourproductionapp.com'
+  // Add any other specific, trusted origins here.
+]
+
+export async function GET(
+  req: NextRequest,
+  { params }: { params: Promise<{ userId: string; slug: string }> }
+) {
+  const { userId, slug } = await params
+
+  if (!userId || !slug) {
+    return NextResponse.json({ error: 'Invalid path' }, { status: 400 })
+  }
+
+  // SECURITY FIX: Prevent Cross-Tenant Data Exposure.
+  // Enforce session validation to ensure the caller is authenticated.
+  const token = req.cookies.get('realism-session')?.value
+  if (!token) {
+    return NextResponse.json({ error: 'Unauthorized: Session required' }, { status: 401 })
+  }
+
+  const authenticatedUserId = await validateSession(token)
+
+  // Enforce ownership: The caller must own the requested data plan or have an explicitly issued capability token.
+  if (authenticatedUserId !== userId) {
+    return NextResponse.json({ error: 'Forbidden: Access denied to requested resource' }, { status: 403 })
+  }
+
+  const plan = await getDataPlan(userId, slug)
+  if (!plan) {
+    return NextResponse.json(
+      { error: 'App not found or data plan missing' },
+      { status: 404 }
+    )
+  }
+
+  // SECURITY FIX: Restrict CORS to approved origins.
+  // We no longer return Access-Control-Allow-Origin: '*' which permitted credentialed public fetches.
+  const origin = req.headers.get('origin')
+  let corsOrigin = ''
+  if (origin && ALLOWED_ORIGINS.includes(origin)) {
+    corsOrigin = origin
+  } else if (process.env.NEXT_PUBLIC_APP_URL) {
+    corsOrigin = process.env.NEXT_PUBLIC_APP_URL
+  }
+
+  const corsHeaders = {
+    'Cache-Control': 'no-store',
+    ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+  }
+
+  const cached = await getCachedData(userId, slug)
+  if (cached) {
+    return NextResponse.json(
+      { ...cached, cached: true },
+      { headers: corsHeaders }
+    )
+  }
+
+  const result = await executeAllFetches(plan)
+
+  await setCachedData(userId, slug, result, plan.cacheTTL)
+
+  return NextResponse.json(result, { headers: corsHeaders })
+}