21 lines
1.4 KiB
Markdown
21 lines
1.4 KiB
Markdown
# Task 05: Auth & CSRF на POST /api/posts/preview
|
|
|
|
**Assigned to:** Antigravity (Implementation Orchestrator)
|
|
**Priority:** MEDIUM (security)
|
|
**Date:** 2026-08-21
|
|
**Base SHA:** `4b8c6b10395452a3fd1ff7ea4eb919289b66f33f`
|
|
|
|
## Scope
|
|
1. Add `validateCsrfOrigin(req)` to `POST /api/posts/preview` (`src/app/api/posts/preview/route.ts`).
|
|
2. Require authenticated session (`requireAuthenticatedUser(req)`) on `POST /api/posts/preview`:
|
|
- Post preview is step 1 of giveaway creation wizard which immediately calls `POST /api/giveaways` (already requiring authentication).
|
|
- Prevents open VK API proxy abuse and unauthenticated server token quota draining.
|
|
- User-scoped rate limit: `expensiveApiRateLimiter.assertAllowed('post-preview:' + sessionUser.id)`.
|
|
3. Preserve `resolveEffectiveCapabilities` truthfulness from actual `post.resolvedAuthType` (Phase 2.3.1 invariant).
|
|
4. Update UI in `src/app/giveaways/new/page.tsx` to handle 401 cleanly with redirect/re-login prompt.
|
|
5. Create test suite `tests/post-preview-guard.test.ts`:
|
|
- Cross-site POST with untrusted Origin -> 403 Forbidden.
|
|
- POST without authenticated session -> 401 Unauthorized.
|
|
- `VK_SERVICE_TOKEN` never leaked in response.
|
|
- Legitimate authenticated same-origin request -> 200 OK with accurate effective capabilities.
|
|
6. Verify gate and submit report to `agents/antigravity/done/TASK-2026-08-21-05-post-preview-auth.md`.
|