ochenstarik/randomayzer
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
randomayzer/agents/antigravity/inbox/TASK-2026-08-21-05-post-preview-auth.md

1.4 KiB
Raw Blame History

Task 05: Auth & CSRF на POST /api/posts/preview

Assigned to: Antigravity (Implementation Orchestrator)
Priority: MEDIUM (security)
Date: 2026-08-21
Base SHA: 4b8c6b10395452a3fd1ff7ea4eb919289b66f33f

Scope

  1. Add validateCsrfOrigin(req) to POST /api/posts/preview (src/app/api/posts/preview/route.ts).
  2. Require authenticated session (requireAuthenticatedUser(req)) on POST /api/posts/preview:
    • Post preview is step 1 of giveaway creation wizard which immediately calls POST /api/giveaways (already requiring authentication).
    • Prevents open VK API proxy abuse and unauthenticated server token quota draining.
    • User-scoped rate limit: expensiveApiRateLimiter.assertAllowed('post-preview:' + sessionUser.id).
  3. Preserve resolveEffectiveCapabilities truthfulness from actual post.resolvedAuthType (Phase 2.3.1 invariant).
  4. Update UI in src/app/giveaways/new/page.tsx to handle 401 cleanly with redirect/re-login prompt.
  5. Create test suite tests/post-preview-guard.test.ts:
    • Cross-site POST with untrusted Origin -> 403 Forbidden.
    • POST without authenticated session -> 401 Unauthorized.
    • VK_SERVICE_TOKEN never leaked in response.
    • Legitimate authenticated same-origin request -> 200 OK with accurate effective capabilities.
  6. Verify gate and submit report to agents/antigravity/done/TASK-2026-08-21-05-post-preview-auth.md.