security: P0 fixes — IDOR on incident/CAPA, CAPA non-owner write, timing-safe recheck cron, auth callback open redirect

app/api/incidents/[id]/route.ts

@@ -8,6 +8,10 @@ export async function GET(_req: Request, { params }: { params: Promise<{ id: str
   const supabase = await createClient()
   const { data, error: authError } = await supabase.auth.getUser()
   if (authError || !data?.user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const user = data.user
+
+  const { data: profile } = await supabase.from('users').select('role, site_id').eq('id', user.id).single()
+  const role = profile?.role ?? ''
 
   const { data: incident, error } = await supabase
     .from('incidents')
@@ -28,5 +32,12 @@ export async function GET(_req: Request, { params }: { params: Promise<{ id: str
     return NextResponse.json({ error: 'Not found' }, { status: 404 })
   }
 
+  const reporter = incident.reporter as unknown as { id: string } | null
+  const isOwner = reporter?.id === user.id
+  const isSiteStaff = ['hse', 'supervisor', 'admin'].includes(role)
+  if (!isOwner && !isSiteStaff) {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+
   return NextResponse.json(incident)
 }