From 21bccce4a1058fe2194df998033b021542466df5 Mon Sep 17 00:00:00 2001
From: diegosouzapw <diegosouzapw@users.noreply.github.com>
Date: Thu, 16 Apr 2026 17:29:22 -0300
Subject: [PATCH] fix(security): prevent arbitrary API keys from accessing
 dashboard management routes (#1353)

---
 src/lib/api/requireManagementAuth.ts | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/src/lib/api/requireManagementAuth.ts b/src/lib/api/requireManagementAuth.ts
index 3d81d1aa77..55820964e3 100644
--- a/src/lib/api/requireManagementAuth.ts
+++ b/src/lib/api/requireManagementAuth.ts
@@ -1,12 +1,35 @@
-import { isAuthenticated, isAuthRequired } from "@/shared/utils/apiAuth";
+import { isAuthRequired } from "@/shared/utils/apiAuth";
 import { createErrorResponse } from "@/lib/api/errorResponse";
+import { jwtVerify } from "jose";
+import { cookies } from "next/headers";
+
+/**
+ * Checks if the request is authenticated strictly via a Dashboard Session (JWT Cookie).
+ * Standard Bearer API keys are rejected for management routes to prevent privilege escalation.
+ */
+async function isDashboardSessionAuthenticated(): Promise<boolean> {
+  if (process.env.JWT_SECRET) {
+    try {
+      const cookieStore = await cookies();
+      const token = cookieStore.get("auth_token")?.value;
+      if (token) {
+        const secret = new TextEncoder().encode(process.env.JWT_SECRET);
+        await jwtVerify(token, secret);
+        return true;
+      }
+    } catch {
+      // Invalid/expired token
+    }
+  }
+  return false;
+}
 
 export async function requireManagementAuth(request: Request): Promise<Response | null> {
   if (!(await isAuthRequired())) {
     return null;
   }
 
-  if (await isAuthenticated(request)) {
+  if (await isDashboardSessionAuthenticated()) {
     return null;
   }