correction faille de securité

app/api/businesses/[id]/route.ts

@@ -1,15 +1,20 @@
 import { NextRequest, NextResponse } from 'next/server'
 import prisma from '@/lib/prisma'
-import { USER_SAFE_SELECT } from '@/lib/auth-utils'
+import { USER_SAFE_SELECT, getAuthUser } from '@/lib/auth-utils'
 
 type Params = { params: Promise<{ id: string }> }
 
 // GET /api/businesses/[id]
 export async function GET(
-  _request: NextRequest, 
+  request: NextRequest, 
   context: { params: Promise<{ id: string }> }
 ): Promise<Response> {
     try {
+        const user = await getAuthUser(request)
+        if (!user) {
+            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
+        }
+
         const { id } = await context.params
         const business = await prisma.business.findFirst({
             where: {
@@ -26,7 +31,13 @@ export async function GET(
             },
         })
         if (!business) return NextResponse.json({ error: 'Non trouvé' }, { status: 404 })
-        return NextResponse.json(business)
+        
+        // Mask technical IDs
+        const { id: bizId, ownerId, ...rest } = business
+        return NextResponse.json({ 
+            ...rest, 
+            id: business.slug || bizId 
+        })
     } catch (error) {
         console.error('GET /api/businesses/[id] error:', error)
         return NextResponse.json({ error: 'Erreur serveur' }, { status: 500 })