duffyduckandClaude Opus 4.7
8aead8c2f6
- JWT-Algorithmus fest auf HS256 (Defense-in-Depth gegen alg-confusion)
- app.set('trust proxy', 1) – Rate-Limiter wirkt jetzt auch hinter Reverse-Proxy
- IDOR-Fix: Invoice-ECD-Endpoints + PDF-Template-Generierung (canAccessContract/ECD)
- Email-Anhang-Download: Content-Type-Safelist, SVG nie inline, nosniff, Filename-CRLF-Sanitize
- Provider/Tariff-GET-Routen: requirePermission('providers:read') (Portal-Kunden raus)
- SMTP-Header-Injection zentral in sendEmail blockiert (schützt alle Caller)
- bcrypt-Cost 10 → 12 (OWASP 2026)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
20 lines
1.1 KiB
TypeScript
20 lines
1.1 KiB
TypeScript
import { Router } from 'express';
|
|
import * as providerController from '../controllers/provider.controller.js';
|
|
import * as tariffController from '../controllers/tariff.controller.js';
|
|
import { authenticate, requirePermission } from '../middleware/auth.js';
|
|
|
|
const router = Router();
|
|
|
|
// Provider routes (Portal-Kunden sollen keine Provider-Liste/Tarife sehen)
|
|
router.get('/', authenticate, requirePermission('providers:read'), providerController.getProviders);
|
|
router.post('/', authenticate, requirePermission('providers:create'), providerController.createProvider);
|
|
router.get('/:id', authenticate, requirePermission('providers:read'), providerController.getProvider);
|
|
router.put('/:id', authenticate, requirePermission('providers:update'), providerController.updateProvider);
|
|
router.delete('/:id', authenticate, requirePermission('providers:delete'), providerController.deleteProvider);
|
|
|
|
// Nested tariff routes
|
|
router.get('/:providerId/tariffs', authenticate, requirePermission('providers:read'), tariffController.getTariffs);
|
|
router.post('/:providerId/tariffs', authenticate, requirePermission('providers:create'), tariffController.createTariff);
|
|
|
|
export default router;
|