security: CAPA privilege escalation, CSV injection, AI rate-limit, prompt injection guard, open redirect, timing-safe cron secret, server-only admin client, notifications RLS

app/api/capa/[id]/route.ts

@@ -36,7 +36,17 @@ export async function PATCH(
   const { data: { user }, error: authError } = await supabase.auth.getUser()
   if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
+  const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
+  const role = profile?.role ?? ''
+
   const body = await request.json()
+
+  // Only hse/admin can set privileged statuses — owner can only move to in_progress/pending_verification
+  const privilegedStatuses = ['verified', 'reopened', 'closed']
+  if (body.status && privilegedStatuses.includes(body.status) && !['hse', 'admin'].includes(role)) {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+
   const allowed = ['description', 'due_date', 'priority', 'status', 'department', 'root_cause_ref']
   const update: Record<string, unknown> = {}
   for (const key of allowed) {