Marketing/4ventures-client-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): harden auth, tenant scoping, and scrub secrets

Browse Source 
Require session on APIs, scope KPIs/activos/simulate to the user tenant, strip real JWTs from .env.example, and add health/smoke/docs for 4Ventures ops.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
4Ventures
2026-09-21 10:51:46 +02:00
parent e7b6ab71ca
commit 2df3fe6983
21 changed files with 621 additions and 276 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
src/app/dashboard/activos/page.tsx
View File

@@ -1,34 +1,48 @@
import React from 'react';
import { FileText, CheckCircle2 } from 'lucide-react';
import { createClient } from '@/lib/supabase/server';
export const revalidate = 0;
export default async function ActivosPage() {
const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || 'https://supabase.4ventures.es';
const anonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY || '';
const supabase = await createClient();
const {
data: { user },
} = await supabase.auth.getUser();
let documents: any[] = [];
try {
const res = await fetch(`${supabaseUrl}/rest/v1/documents?select=*&order=created_at.desc`, {
headers: {
apikey: anonKey,
Authorization: `Bearer ${anonKey}`
},
cache: 'no-store'
});
if (res.ok) {
documents = await res.json();
let documents: Array<{
id: string;
type?: string;
title?: string;
content?: string;
version?: number;
created_at?: string;
status?: string;
}> = [];
if (user) {
// Relies on RLS: only documents for the caller's tenant
const { data, error } = await supabase
.from('documents')
.select('id,type,title,content,version,created_at,status')
.eq('status', 'approved')
.order('created_at', { ascending: false });
if (error) {
console.error('Error fetching documents:', error.message);
} else {
documents = data ?? [];
}
} catch (e) {
console.error('Error fetching documents:', e);
}
return (
<div className="space-y-8">
<div>
<h2 className="text-2xl font-bold tracking-tight text-white">Biblioteca de Activos & Entregables</h2>
<h2 className="text-2xl font-bold tracking-tight text-white">
Biblioteca de Activos & Entregables
</h2>
<p className="text-sm text-gray-400 mt-1">
Documentos, copys, calendarios y briefs producidos por los agentes de IA y aprobados por el equipo en Slack.
Documentos, copys, calendarios y briefs producidos por los agentes de IA
y aprobados por el equipo en Slack. Filtrado por tenant (RLS).
</p>
</div>
@@ -36,14 +50,20 @@ export default async function ActivosPage() {
{documents.length === 0 ? (
<div className="col-span-3 bg-[#111827] border border-gray-800 rounded-xl p-12 text-center text-gray-400">
<FileText className="w-10 h-10 text-gray-600 mx-auto mb-3" />
<p className="text-base font-medium text-gray-300">No hay activos aprobados todavía.</p>
<p className="text-base font-medium text-gray-300">
No hay activos aprobados todavía.
</p>
<p className="text-xs text-gray-400 mt-1">
Los activos generados por los agentes aparecerán aquí tras ser validados en Slack.
Los activos generados por los agentes aparecerán aquí tras ser
validados en Slack.
</p>
</div>
) : (
documents.map((doc) => (
<div key={doc.id} className="bg-[#111827] border border-gray-800 rounded-xl p-5 flex flex-col justify-between">
<div
key={doc.id}
className="bg-[#111827] border border-gray-800 rounded-xl p-5 flex flex-col justify-between"
>
<div>
<div className="flex items-center justify-between mb-3">
<span className="uppercase text-[10px] font-bold px-2 py-0.5 rounded bg-gray-800 text-gray-300">
@@ -58,7 +78,11 @@ export default async function ActivosPage() {
</div>
<div className="pt-4 border-t border-gray-800/80 mt-4 text-[11px] text-gray-400 flex justify-between">
<span>Versión v{doc.version}</span>
<span>{new Date(doc.created_at).toLocaleDateString('es-ES')}</span>
<span>
{doc.created_at
? new Date(doc.created_at).toLocaleDateString('es-ES')
: '—'}
</span>
</div>
</div>
))