fix: gate admin routes against cross-origin CSRF

2026-05-18 13:21:01 +02:00
parent b299a0b602
commit c2eb2c081b
16 changed files with 82 additions and 39 deletions
@@ -13,9 +13,9 @@ import {
 * GET /api/admin/version
 * Returns the cached update status, last check times, and effective config.
 */
-export async function GET() {
+export async function GET(request: NextRequest) {
  try {
-    const auth = await requireAdminAuth();
+    const auth = await requireAdminAuth(request);
    if ('error' in auth) return auth.error;

    const state = await loadState();
@@ -47,7 +47,7 @@ export async function GET() {
 */
 export async function POST(req: NextRequest) {
  try {
-    const auth = await requireAdminAuth();
+    const auth = await requireAdminAuth(req);
    if ('error' in auth) return auth.error;

    const body = (await req.json().catch(() => null)) as { action?: string } | null;