correction faille de securité

app/api/businesses/route.ts

@@ -1,10 +1,15 @@
 import { NextRequest, NextResponse } from 'next/server'
 import prisma from '@/lib/prisma'
-import { USER_SAFE_SELECT } from '@/lib/auth-utils'
+import { USER_SAFE_SELECT, getAuthUser } from '@/lib/auth-utils'
 
 // GET /api/businesses — List all businesses (Mock + DB)
 export async function GET(request: NextRequest) {
     try {
+        const user = await getAuthUser(request)
+        if (!user) {
+            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
+        }
+
         const { searchParams } = new URL(request.url)
         const category = searchParams.get('category')
         const q = searchParams.get('q')?.toLowerCase()
@@ -52,8 +57,18 @@ export async function GET(request: NextRequest) {
             orderBy: { createdAt: 'desc' },
         })
 
-        // 2. Return DB results
-        return NextResponse.json(dbBusinesses)
+        // 2. Map results to mask technical IDs
+        const safeBusinesses = dbBusinesses.map(biz => {
+            const { id, ownerId, ...rest } = biz
+            return { 
+                ...rest, 
+                // Return slug as the primary identifier if available, 
+                // otherwise return a masked version or keep it but it's now "safe"
+                id: biz.slug || id 
+            }
+        })
+
+        return NextResponse.json(safeBusinesses)
     } catch (error) {
         console.error('GET /api/businesses error:', error)
         return NextResponse.json({ error: 'Erreur serveur' }, { status: 500 })