security: P0 fixes — IDOR on incident/CAPA, CAPA non-owner write, timing-safe recheck cron, auth callback open redirect

app/api/capa/[id]/route.ts

@@ -24,7 +24,19 @@ export async function GET(
     .single()
 
   if (error || !data) return NextResponse.json({ error: 'Not found' }, { status: 404 })
-  return NextResponse.json(data)
+
+  const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
+  const role = profile?.role ?? ''
+  const isOwner = data.owner_user_id === user.id
+  const canRead = ['hse', 'admin', 'supervisor'].includes(role) || isOwner
+  if (!canRead) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+
+  // Strip owner email for non-privileged roles — only name needed
+  const result = ['hse', 'admin'].includes(role)
+    ? data
+    : { ...data, owner: { name: (data.owner as unknown as { name: string } | null)?.name ?? '' } }
+
+  return NextResponse.json(result)
 }
 
 export async function PATCH(
@@ -39,9 +51,14 @@ export async function PATCH(
   const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
   const role = profile?.role ?? ''
 
+  const { data: capa } = await supabase.from('capa_actions').select('owner_user_id').eq('id', id).single()
+  const isOwner = capa?.owner_user_id === user.id
+  const canEdit = ['hse', 'admin'].includes(role) || isOwner
+  if (!canEdit) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+
   const body = await request.json()
 
-  // Only hse/admin can set privileged statuses — owner can only move to in_progress/pending_verification
+  // Only hse/admin can set privileged statuses
   const privilegedStatuses = ['verified', 'reopened', 'closed']
   if (body.status && privilegedStatuses.includes(body.status) && !['hse', 'admin'].includes(role)) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })