correction faille de securité

app/api/businesses/[id]/route.ts

@@ -1,15 +1,20 @@
 import { NextRequest, NextResponse } from 'next/server'
 import prisma from '@/lib/prisma'
-import { USER_SAFE_SELECT } from '@/lib/auth-utils'
+import { USER_SAFE_SELECT, getAuthUser } from '@/lib/auth-utils'
 
 type Params = { params: Promise<{ id: string }> }
 
 // GET /api/businesses/[id]
 export async function GET(
-  _request: NextRequest, 
+  request: NextRequest, 
   context: { params: Promise<{ id: string }> }
 ): Promise<Response> {
     try {
+        const user = await getAuthUser(request)
+        if (!user) {
+            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
+        }
+
         const { id } = await context.params
         const business = await prisma.business.findFirst({
             where: {
@@ -26,7 +31,13 @@ export async function GET(
             },
         })
         if (!business) return NextResponse.json({ error: 'Non trouvé' }, { status: 404 })
-        return NextResponse.json(business)
+        
+        // Mask technical IDs
+        const { id: bizId, ownerId, ...rest } = business
+        return NextResponse.json({ 
+            ...rest, 
+            id: business.slug || bizId 
+        })
     } catch (error) {
         console.error('GET /api/businesses/[id] error:', error)
         return NextResponse.json({ error: 'Erreur serveur' }, { status: 500 })

app/api/businesses/route.ts

@@ -1,10 +1,15 @@
 import { NextRequest, NextResponse } from 'next/server'
 import prisma from '@/lib/prisma'
-import { USER_SAFE_SELECT } from '@/lib/auth-utils'
+import { USER_SAFE_SELECT, getAuthUser } from '@/lib/auth-utils'
 
 // GET /api/businesses — List all businesses (Mock + DB)
 export async function GET(request: NextRequest) {
     try {
+        const user = await getAuthUser(request)
+        if (!user) {
+            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
+        }
+
         const { searchParams } = new URL(request.url)
         const category = searchParams.get('category')
         const q = searchParams.get('q')?.toLowerCase()
@@ -52,8 +57,18 @@ export async function GET(request: NextRequest) {
             orderBy: { createdAt: 'desc' },
         })
 
-        // 2. Return DB results
-        return NextResponse.json(dbBusinesses)
+        // 2. Map results to mask technical IDs
+        const safeBusinesses = dbBusinesses.map(biz => {
+            const { id, ownerId, ...rest } = biz
+            return { 
+                ...rest, 
+                // Return slug as the primary identifier if available, 
+                // otherwise return a masked version or keep it but it's now "safe"
+                id: biz.slug || id 
+            }
+        })
+
+        return NextResponse.json(safeBusinesses)
     } catch (error) {
         console.error('GET /api/businesses error:', error)
         return NextResponse.json({ error: 'Erreur serveur' }, { status: 500 })

app/api/favorites/route.ts

@@ -43,12 +43,29 @@ export async function POST(request: NextRequest) {
             return NextResponse.json({ error: 'businessId requis' }, { status: 400 });
         }
 
+        // Resolve business ID (in case slug was passed)
+        const business = await prisma.business.findFirst({
+            where: {
+                OR: [
+                    { id: businessId },
+                    { slug: businessId }
+                ]
+            },
+            select: { id: true }
+        });
+
+        if (!business) {
+            return NextResponse.json({ error: 'Entreprise non trouvée' }, { status: 404 });
+        }
+
+        const actualBusinessId = business.id;
+
         // Check if already favorited
         const existing = await prisma.favorite.findUnique({
             where: {
                 userId_businessId: {
                     userId,
-                    businessId
+                    businessId: actualBusinessId
                 }
             }
         });
@@ -64,7 +81,7 @@ export async function POST(request: NextRequest) {
             await prisma.favorite.create({
                 data: {
                     userId,
-                    businessId
+                    businessId: actualBusinessId
                 }
             });
             return NextResponse.json({ favorited: true });