C: Fix critical issues — proto clamping, entities export auth, DB_SCHEMA default

[davidpomerenke]

Summary\n\nFixes three bugs identified in the code review (REVIEW.md):\n\n### Fix 1 — Clamp x-forwarded-proto to known schemes (src/lib/get-base-url.ts)\n\ngetBaseUrl() previously passed the raw x-forwarded-proto header value directly into the URL scheme. An attacker who can craft requests to a directly-exposed Node process could set this header to an arbitrary value (e.g., http) and downgrade the magic-link URL in emails to plain HTTP, causing the token to be transmitted in clear text.\n\nNow the scheme is clamped: only \"http\" and \"https\" are accepted; anything else (including absence of the header) defaults to \"https\". Localhost is always forced to \"http\" regardless.\n\n### Fix 2 — Add admin auth guard to entities export route (src/app/api/export/entities/route.ts)\n\nThe POST /api/export/entities endpoint accepted arbitrary JSON data and rendered it to a UN-branded Excel file with no authentication. Any unauthenticated caller could generate spoofed UN-branded spreadsheets.\n\nNow the route calls getCurrentUser() and returns 403 unless the user is an admin.\n\n### Fix 3 — Unify DB_SCHEMA default in src/lib/config.ts\n\nThe config.ts file exported DB_SCHEMA with a default of \"app\", while every API route that used the schema directly re-declared it locally with the correct default of \"sg_reports_survey\". These inconsistent defaults would cause auth queries to silently target the wrong schema on a fresh deployment without DB_SCHEMA set.\n\nThe default in config.ts is now \"sg_reports_survey\" (matching the SQL files), making it safe to import from there rather than re-declaring locally.\n\n## Test plan\n\n- [ ] pnpm typecheck — no errors\n- [ ] pnpm build — builds cleanly\n- [ ] Unauthenticated POST /api/export/entities returns 403\n- [ ] Non-admin authenticated POST /api/export/entities returns 403\n- [ ] Admin POST /api/export/entities still returns Excel file\n- [ ] Magic-link emails use https:// when x-forwarded-proto is absent or contains a non-standard value\n- [ ] Magic-link emails use http:// for localhost\n\n🤖 Generated with Claude Code

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
un80-sg-reports-survey	Ready	Preview, Comment	Jun 17, 2026 6:18am