From ce9dc8e851897eb2500ab58c3cd3a4e9ad0e27c3 Mon Sep 17 00:00:00 2001
From: diegosouzapw <diegosouzapw@users.noreply.github.com>
Date: Sat, 25 Apr 2026 16:15:39 -0300
Subject: [PATCH] fix(security): resolve vulnerability scan findings

- Added requireManagementAuth to /api/logs/export
- Added requireManagementAuth to /api/logs/console
- Added requireManagementAuth to /api/compliance/audit-log
- Increased minimum password length from 4 to 8 in reset-password CLI
---
 bin/reset-password.mjs                    | 6 +++---
 src/app/api/compliance/audit-log/route.ts | 4 ++++
 src/app/api/logs/console/route.ts         | 4 ++++
 src/app/api/logs/export/route.ts          | 4 ++++
 4 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/bin/reset-password.mjs b/bin/reset-password.mjs
index 9a1fcbcc00..e1d85eced8 100644
--- a/bin/reset-password.mjs
+++ b/bin/reset-password.mjs
@@ -70,10 +70,10 @@ async function main() {
     console.log("ℹ️  No password is currently set.");
   }
 
-  const password = await ask("Enter new password (min 4 chars): ");
+  const password = await ask("Enter new password (min 8 chars): ");
 
-  if (!password || password.length < 4) {
-    console.error("\n❌ Password must be at least 4 characters.\n");
+  if (!password || password.length < 8) {
+    console.error("\n❌ Password must be at least 8 characters.\n");
     db.close();
     rl.close();
     process.exit(1);
diff --git a/src/app/api/compliance/audit-log/route.ts b/src/app/api/compliance/audit-log/route.ts
index e34bd8f109..974974564c 100644
--- a/src/app/api/compliance/audit-log/route.ts
+++ b/src/app/api/compliance/audit-log/route.ts
@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { countAuditLog, getAuditLog } from "@/lib/compliance/index";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 
 export const dynamic = "force-dynamic";
 
@@ -10,6 +11,9 @@ function parsePagination(value: string | null, fallback: number, min: number, ma
 }
 
 export async function GET(request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
   try {
     const { searchParams } = new URL(request.url);
     const filters = {
diff --git a/src/app/api/logs/console/route.ts b/src/app/api/logs/console/route.ts
index 96fb706825..cdfe0984dc 100644
--- a/src/app/api/logs/console/route.ts
+++ b/src/app/api/logs/console/route.ts
@@ -13,6 +13,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { readFileSync, existsSync } from "fs";
 import { getAppLogFilePath } from "@/lib/logEnv";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 
 const LEVEL_ORDER: Record<string, number> = {
   trace: 5,
@@ -45,6 +46,9 @@ function parseLevel(raw: string | number): string {
 }
 
 export async function GET(req: NextRequest) {
+  const authError = await requireManagementAuth(req);
+  if (authError) return authError;
+
   try {
     const { searchParams } = new URL(req.url);
     const levelFilter = searchParams.get("level") || "all";
diff --git a/src/app/api/logs/export/route.ts b/src/app/api/logs/export/route.ts
index 3e25814332..2929985abc 100644
--- a/src/app/api/logs/export/route.ts
+++ b/src/app/api/logs/export/route.ts
@@ -1,5 +1,6 @@
 import { getDbInstance } from "@/lib/db/core";
 import { exportCallLogsSince } from "@/lib/usage/callLogs";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 
 /**
  * GET /api/logs/export — export logs as JSON
@@ -7,6 +8,9 @@ import { exportCallLogsSince } from "@/lib/usage/callLogs";
  *               &type=call-logs|request-logs|proxy-logs (default call-logs)
  */
 export async function GET(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
   try {
     const { searchParams } = new URL(request.url);
     const hours = Math.min(Math.max(parseInt(searchParams.get("hours") || "24") || 24, 1), 168);