Security Architecture

// The shared concerns withApiAuth applies before your handler runs:
// 1. IP-based pre-auth rate limiting (cheap flood rejection)
// 2. API-key authentication against the database
// 3. Adaptive, key- and workspace-scoped rate limiting
// 4. Declarative permission checks
// 5. Workspace-scoped data access via an admin Supabase client

export const GET = withApiAuth(
  async (request, { context }) => {
    // Security is already enforced by the withApiAuth wrapper:
    // - API key authenticated
    // - Rate limiting applied (IP pre-auth + key/workspace-scoped)
    // - 'manage_drive' permission verified for this workspace
    const { wsId } = context;

    // Use the admin client for SDK routes (no user session cookies).
    // createDynamicAdminClient is async — await it.
    const supabase = await createDynamicAdminClient();

    return supabase.storage.from('workspaces').list(wsId /* ... */);
  },
  {
    permissions: ['manage_drive'], // Declarative authorization
    // Custom limits are also supported, e.g.:
    // rateLimit: { windowMs: 60000, maxRequests: 20 }
  }
);

// apps/backend/src/supabase_auth.rs — real backend auth (simplified)
// 1. Pull the access token from a Bearer header or the Supabase auth cookie.
// 2. Verify it against Supabase Auth's /user endpoint using the service-role key.
// 3. Only a verified user proceeds; nothing is trusted by network location.
let access_token = request_access_token(request)?;            // bearer or cookie
let user = fetch_supabase_auth_user(contact_data, &access_token, outbound).await?;

-- RLS policy ensures data access is validated at database level
-- Even if application code is compromised, database enforces security

CREATE POLICY "workspace_members_select_policy"
ON workspace_members FOR SELECT
TO authenticated
USING (
  -- User can only see members of workspaces they belong to
  EXISTS (
    SELECT 1 FROM workspace_members wm
    WHERE wm.ws_id = workspace_members.ws_id
    AND wm.user_id = auth.uid()
  )
);

-- Finance-specific tables with dedicated RLS policies
CREATE TABLE finance_transactions (
  id UUID PRIMARY KEY,
  workspace_id UUID NOT NULL,
  amount DECIMAL NOT NULL,
  -- ... other fields
);

-- RLS policy specific to finance module
CREATE POLICY "finance_transactions_policy"
ON finance_transactions
TO authenticated
USING (
  -- Only users with finance permissions in workspace
  EXISTS (
    SELECT 1 FROM workspace_members wm
    WHERE wm.ws_id = finance_transactions.workspace_id
    AND wm.user_id = auth.uid()
    AND wm.role IN ('owner', 'admin', 'finance_manager')
  )
);

-- AI chat tables completely separate
CREATE TABLE ai_chat_messages (
  id UUID PRIMARY KEY,
  workspace_id UUID NOT NULL,
  message TEXT NOT NULL,
  -- ... other fields
);

-- Different RLS policy for AI data
CREATE POLICY "ai_chat_messages_policy"
ON ai_chat_messages
TO authenticated
USING (
  EXISTS (
    SELECT 1 FROM workspace_members wm
    WHERE wm.ws_id = ai_chat_messages.workspace_id
    AND wm.user_id = auth.uid()
  )
);

// First line of defense — applied by withApiAuth + Next.js middleware + Vercel edge:
// - API-key / session authentication
// - IP-based and key/workspace-scoped rate limiting
// - Request validation (e.g. zod query schemas)
// Note: there is no separate gateway process; these run at the route boundary.

// Second line of defense - Application logic
export async function handleFinanceRequest(request: Request) {
  const user = await getCurrentUser(); // Verify user session

  // Application-level authorization
  const hasPermission = await userHasFinanceAccess(user.id, workspaceId);
  if (!hasPermission) {
    throw new ForbiddenError('No finance access');
  }

  // Business logic with additional checks
  return processFinanceOperation();
}

-- Third line of defense - Database RLS
CREATE POLICY "finance_access_policy"
ON finance_transactions
TO authenticated
USING (
  -- Even if application is compromised,
  -- database enforces access control
  workspace_id IN (
    SELECT ws_id FROM workspace_members
    WHERE user_id = auth.uid()
    AND role IN ('owner', 'admin', 'finance_manager')
  )
);

// Fourth line of defense - Encryption at rest
// Supabase automatically encrypts data at rest
// Sensitive fields additionally encrypted in application

async function storeSensitiveData(data: SensitiveData) {
  const encrypted = await encrypt(data, ENCRYPTION_KEY);
  await database.insert({
    data: encrypted,
    // Even with database access, data is encrypted
  });
}

// Illustrative: how a critical operation could record an audit entry.
// There is no global event store today; persist via your table's history
// mechanism and emit server-side logs through native console methods.
export async function updateWorkspaceSettings(
  workspaceId: string,
  settings: WorkspaceSettings,
  userId: string
) {
  const previousSettings = await getSettings(workspaceId);

  // Apply the change.
  await updateSettings(workspaceId, settings);

  // Record an audit entry (target: append-only audit table or log-drain).
  await recordAuditEntry({
    event: 'workspace.settings.updated',
    workspaceId,
    userId,
    previousSettings,
    newSettings: settings,
    occurredAt: new Date().toISOString(),
  });
}

// Security-sensitive event names worth auditing (illustrative set)
export const AUDIT_EVENTS = {
  'user.login': 'User authentication',
  'user.logout': 'User session end',
  'user.password.changed': 'Password modification',
  'user.mfa.enabled': 'MFA enabled',
  'user.mfa.disabled': 'MFA disabled',
  'workspace.member.added': 'Member added to workspace',
  'workspace.member.removed': 'Member removed from workspace',
  'workspace.role.changed': 'Member role modified',
  'finance.transaction.created': 'Financial transaction',
  'data.export.requested': 'Data export initiated',
  'api.key.created': 'API key generated',
  'api.key.revoked': 'API key revoked',
} as const;

// Illustrative: querying an append-only audit table once one exists.
export async function getAuditLog(filters: AuditFilters) {
  const supabase = await createDynamicAdminClient(); // async — await it
  return supabase
    .from('audit_events')
    .select('event_type, user_id, workspace_id, created_at, payload')
    .eq('workspace_id', filters.workspaceId)
    .gte('created_at', filters.startDate)
    .lte('created_at', filters.endDate)
    .in('event_type', filters.events)
    .order('created_at', { ascending: false });
}

import { task } from '@trigger.dev/sdk/v3';

// A task you trigger (e.g. from an API route) when repeated auth failures
// are observed, to evaluate and respond to a possible brute-force attempt.
export const securityScanTask = task({
  id: 'security-scan',
  queue: { concurrencyLimit: 5 },
  run: async (payload: { userId: string; windowSeconds?: number }) => {
    const recentFailures = await countRecentLoginFailures(
      payload.userId,
      payload.windowSeconds ?? 300 // 5 minutes
    );

    if (recentFailures > 5) {
      // Respond (e.g. temporary lock + notify) and return a structured result.
      await applyTemporaryLock(payload.userId);
      return { userId: payload.userId, action: 'account.lock.temporary' };
    }

    return { userId: payload.userId, action: 'none' };
  },
});