admin and Claude Sonnet 4.6
16dd62df11
fix: P1 API security hardening — rate limits, auth guards, duplicate prevention
...
- verify/route.ts: setDate → setUTCDate to avoid timezone off-by-one on recheck date
- triage-suggest, rca-draft, quality-check: 60s per-user rate limit via audit_log
- quality-check: add write_audit_log (was missing, CLAUDE.md violation)
- investigation POST: 409 if investigation already exists for incident
- incidents POST: 60s per-user rate limit via audit_log
- addenda GET: restrict to hse/admin/supervisor roles
- dashboard/stats GET: restrict to hse/admin/management roles
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ
2026-07-12 20:47:32 +08:00
admin and Claude Sonnet 4.6
b9ab94c9da
feat: API key settings page — store ANTHROPIC/VOYAGE keys in DB with admin UI
...
- Migration: app_settings table with admin-only RLS (ANTHROPIC_API_KEY, VOYAGE_API_KEY)
- lib/settings.ts: getApiKey() reads DB first, falls back to env var
- lib/claude/client.ts: factory createAnthropicClient(apiKey) replaces singleton
- lib/claude/embed.ts: optional apiKey param, falls back to env
- 3 Claude AI routes + similar route: fetch key from settings before calling AI
- incidents/route.ts: fire-and-forget embed reads VOYAGE key from settings
- GET/POST /api/settings: admin-only masked key management endpoint
- /hse/settings page + ApiKeyForm client component
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_01FFDuBhMKvoWjrWT3ZnGmmr
2026-07-11 17:46:40 +08:00
admin and Claude Sonnet 4.6
c07bdb77ad
fix: RLS guard in match_incidents + try/catch around AI/embed calls
...
- Add new migration 20260711000013_match_incidents_auth_guard.sql that
replaces match_incidents with an inline auth guard: callers without
hse/admin role receive PGRST301 Forbidden, closing the SECURITY
DEFINER RLS bypass.
- Wrap anthropic.messages.create() in try/catch returning 503 in all
four AI routes: quality-check, triage-suggest, rca-draft, similar.
- Wrap JSON.parse(inc.embedding) and embedText() in similar/route.ts
in a shared try/catch returning 503 Embedding service unavailable.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_01FFDuBhMKvoWjrWT3ZnGmmr
2026-07-11 16:48:20 +08:00
admin and Claude Sonnet 4.6
10e71969dd
feat: AI RCA draft assistant in investigation form
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_01FFDuBhMKvoWjrWT3ZnGmmr
2026-07-11 16:35:12 +08:00
admin and Claude Sonnet 4.6
f10fa071f9
feat: AI triage suggestion — severity + DOSH flags pre-fill
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_01FFDuBhMKvoWjrWT3ZnGmmr
2026-07-11 16:27:29 +08:00
adminandClaude Sonnet 4.6