feat: Add authentication to platform and auto-sync APIs and remove debug endpoints.

src/app/api/auto-sync/route.ts

@@ -14,6 +14,15 @@ export const maxDuration = 1800 // 30 minutes timeout for auto sync
 let lastAutoSync: Date | null = null
 
 export async function POST(request: NextRequest) {
+  // Check auth - require sync secret or localhost
+  const authResult = await SyncAuth.isSyncAllowed(request)
+  if (!authResult.allowed) {
+    return NextResponse.json(
+      { error: 'Sync operation not allowed', reason: authResult.reason },
+      { status: 403 }
+    )
+  }
+
   try {
     // Check if auto sync is enabled
     if (!SyncAuth.isAutoSyncEnabled()) {

src/app/api/debug-arch/route.ts

@@ -1,36 +0,0 @@
-import { NextResponse } from 'next/server'
-import { query } from '@/lib/database/config'
-
-export async function GET() {
-  try {
-    // Check if arch platform exists
-    const platformResult = await query(
-      'SELECT * FROM platforms WHERE id = $1',
-      ['arch']
-    )
-    
-    // Count arch packages
-    const countResult = await query(
-      'SELECT COUNT(*) FROM packages WHERE platform_id = $1',
-      ['arch']
-    )
-    
-    // Get sample packages
-    const sampleResult = await query(
-      'SELECT name, version, description FROM packages WHERE platform_id = $1 LIMIT 5',
-      ['arch']
-    )
-    
-    return NextResponse.json({
-      platform: platformResult.rows[0] || null,
-      totalPackages: parseInt(countResult.rows[0].count),
-      samplePackages: sampleResult.rows
-    })
-  } catch (error) {
-    console.error('Debug error:', error)
-    return NextResponse.json(
-      { error: error instanceof Error ? error.message : 'Unknown error' },
-      { status: 500 }
-    )
-  }
-}

src/app/api/platforms/[id]/route.ts

@@ -25,10 +25,21 @@ export async function GET(
   }
 }
 
+import { SyncAuth } from '@/lib/sync/auth'
+
 export async function PUT(
   request: NextRequest,
   { params }: { params: { id: string } }
 ) {
+  // Check auth
+  const auth = await SyncAuth.isWriteAllowed(request)
+  if (!auth.allowed) {
+    return NextResponse.json(
+      { error: auth.reason || 'Unauthorized' },
+      { status: 403 }
+    )
+  }
+
   try {
     const body = await request.json()
     const platform = await PlatformService.update(params.id, body)
@@ -54,6 +65,15 @@ export async function DELETE(
   request: NextRequest,
   { params }: { params: { id: string } }
 ) {
+  // Check auth
+  const auth = await SyncAuth.isWriteAllowed(request)
+  if (!auth.allowed) {
+    return NextResponse.json(
+      { error: auth.reason || 'Unauthorized' },
+      { status: 403 }
+    )
+  }
+
   try {
     const success = await PlatformService.delete(params.id)
 

src/app/api/platforms/route.ts

@@ -14,7 +14,18 @@ export async function GET() {
   }
 }
 
+import { SyncAuth } from '@/lib/sync/auth'
+
 export async function POST(request: NextRequest) {
+  // Check auth
+  const auth = await SyncAuth.isWriteAllowed(request)
+  if (!auth.allowed) {
+    return NextResponse.json(
+      { error: auth.reason || 'Unauthorized' },
+      { status: 403 }
+    )
+  }
+
   try {
     const body = await request.json()
     const platform = await PlatformService.create(body)

src/app/api/test-db/route.ts

@@ -1,46 +0,0 @@
-import { NextResponse } from 'next/server'
-import { query } from '@/lib/database/config'
-
-export async function GET() {
-  try {
-    // Test 1: Database connection
-    const dbTest = await query('SELECT NOW() as current_time', [])
-    
-    // Test 2: Packages table count
-    const packageCount = await query('SELECT COUNT(*) as count FROM packages', [])
-    
-    // Test 3: Debian packages count
-    const debianCount = await query('SELECT COUNT(*) as count FROM packages WHERE platform_id = $1', ['debian'])
-    
-    // Test 4: Active packages count
-    const activeCount = await query('SELECT COUNT(*) as count FROM packages WHERE is_active = true', [])
-    
-    // Test 5: Sample packages
-    const samplePackages = await query(`
-      SELECT id, name, version, platform_id 
-      FROM packages 
-      WHERE platform_id = $1 AND is_active = true 
-      LIMIT 5
-    `, ['debian'])
-    
-    return NextResponse.json({
-      database: {
-        connected: true,
-        currentTime: dbTest.rows[0].current_time
-      },
-      packages: {
-        total: packageCount.rows[0].count,
-        debian: debianCount.rows[0].count,
-        active: activeCount.rows[0].count,
-        sample: samplePackages.rows
-      }
-    })
-    
-  } catch (error) {
-    console.error('Database test error:', error)
-    return NextResponse.json({
-      error: error instanceof Error ? error.message : 'Unknown error',
-      database: { connected: false }
-    }, { status: 500 })
-  }
-}