Add admin observability dashboard and harden open-beta security.

Server-side analytics pipeline with admin-only metrics at /admin/observability,
HSTS and share-link RLS fixes, service-role admin writes, and auth redirect hardening.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Your Name

.env.example

@@ -83,6 +83,14 @@ SUPABASE_SERVICE_ROLE_KEY=
 # Admin promotion on login (real email — no .local domains)
 OWNER_EMAIL=kubee3302@gmail.com
 
+# --- Observability / analytics (admin dashboard) ---
+# Service role is required for server-side event storage and admin reads.
+# Run docs/ANALYTICS_SCHEMA.sql once in Supabase SQL editor.
+# Shared secret for middleware → collect route (generate a random string).
+ANALYTICS_INTERNAL_SECRET=
+# Optional salt for IP/session hashing (defaults to a built-in value).
+ANALYTICS_IP_SALT=
+
 # Comma-separated origins for CORS if splitting API later
 ALLOWED_ORIGINS=http://localhost:3000,https://medcore-research-builder.vercel.app
 

.gitignore

@@ -4,6 +4,8 @@ out
 .env
 .env.local
 .env.*.local
+.env.vercel
+.env.vercel
 .DS_Store
 *.log
 .vercel

SECURITY.md

@@ -4,7 +4,7 @@
 
 | Version | Supported |
 |---------|-----------|
-| 2.0.x   | Yes       |
+| 3.7.x   | Yes       |
 
 ## Reporting a vulnerability
 
@@ -23,6 +23,8 @@ We aim to respond within 7 days.
 In scope:
 
 - Server-side API routes (`/api/*`) — injection, SSRF, rate-limit bypass, secret leakage
+- Admin routes (`/admin/*`, `/api/admin/*`) — auth bypass, data exposure
+- Supabase RLS misconfigurations (share links, profiles, analytics)
 - Client-side XSS in manuscript fields or export flows
 - Insecure defaults that expose user drafts or API keys
 
@@ -32,11 +34,25 @@ Out of scope:
 - Social engineering
 - Denial of service against upstream scholarly APIs (PubMed, Crossref, etc.)
 
+## Open-beta security posture
+
+| Area | Posture |
+|------|---------|
+| Auth | Supabase email/password at `/auth`; optional guest mode |
+| Admin | `OWNER_EMAIL` or `profiles.role = admin`; API routes check `getAppUser()` |
+| API keys | Server env only — never `NEXT_PUBLIC_*` except Supabase anon key |
+| Service role | `SUPABASE_SERVICE_ROLE_KEY` server-only (analytics, owner promotion, share reads, announcements) |
+| Rate limits | Per-IP tiers on LLM, search, verify, and default routes; Upstash Redis recommended on Vercel |
+| Share links | Unguessable tokens; reads via service role (no anon table scan) |
+| Analytics | `analytics_events` has RLS with no policies; middleware beacons require `ANALYTICS_INTERNAL_SECRET` |
+| Headers | CSP, HSTS (HTTPS), X-Frame-Options DENY, nosniff, Referrer-Policy |
+| Profiles RLS | Users cannot self-promote to admin (`role` column locked) |
+
 ## Architecture notes
 
-- Drafts are stored in **browser localStorage only** — not on MedCore servers
+- Guest drafts live in **browser localStorage** — not on MedCore servers
+- Cloud sync requires authenticated users (`manuscript_projects` RLS per user)
 - API keys live in **server environment variables** only
-- Rate limits apply per IP on LLM and verification routes (self-hosted; use Redis/Upstash at scale)
 
 ## Safe disclosure
 

app/admin/observability/page.tsx

@@ -0,0 +1,60 @@
+import type { Metadata } from "next";
+import Link from "next/link";
+import { redirect } from "next/navigation";
+import { getAppUser } from "@/lib/auth";
+import { isSupabaseConfigured } from "@/lib/supabase/server";
+import { LogoWordmark } from "@/components/ui/Logo";
+import { ObservabilityDashboard } from "@/components/admin/ObservabilityDashboard";
+
+export const metadata: Metadata = {
+  title: "Observability — MedCore Admin",
+  description: "Admin observability dashboard for visits, usage, abuse signals, and alerts.",
+  robots: { index: false, follow: false },
+};
+
+export default async function AdminObservabilityPage() {
+  if (!isSupabaseConfigured()) {
+    return (
+      <div className="min-h-screen bg-[var(--mc-canvas)] flex items-center justify-center p-6">
+        <div className="card-elevated max-w-md p-8 text-center">
+          <p className="text-med-ink font-medium">Supabase not configured</p>
+          <p className="text-sm text-med-sub mt-2">Admin observability requires Supabase auth.</p>
+          <Link href="/" className="btn-primary inline-block mt-4">
+            Home
+          </Link>
+        </div>
+      </div>
+    );
+  }
+
+  const user = await getAppUser();
+  if (!user || user.role !== "admin") {
+    redirect("/auth?next=/admin/observability");
+  }
+
+  return (
+    <div className="min-h-screen bg-[var(--mc-canvas)]">
+      <header className="sticky top-0 z-20 bg-white/85 backdrop-blur-md border-b border-med-line">
+        <div className="max-w-[1100px] mx-auto px-5 py-3 flex items-center justify-between gap-4">
+          <Link href="/">
+            <LogoWordmark />
+          </Link>
+          <div className="text-right">
+            <p className="text-[11px] uppercase tracking-wide text-med-sub font-medium">Admin</p>
+            <p className="text-sm text-med-ink truncate max-w-[200px]">{user.email}</p>
+          </div>
+        </div>
+      </header>
+      <main className="max-w-[1100px] mx-auto px-5 py-8">
+        <div className="mb-6">
+          <h1 className="display-title text-2xl">Observability</h1>
+          <p className="muted text-sm mt-1 max-w-2xl">
+            Visits, auth activity, feature usage, abuse signals, and alerts for open-beta safety and
+            marketing insights. No raw IPs or user emails are shown in aggregates.
+          </p>
+        </div>
+        <ObservabilityDashboard />
+      </main>
+    </div>
+  );
+}

app/api/_utils.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { BODY_LIMITS, RATE_LIMITS } from "@/lib/constants";
 import { checkRateLimit, clientKey } from "@/lib/rateLimit";
+import { trackFromRequest } from "@/lib/analytics/track";
 
 export function ok<T>(data: T, init?: ResponseInit) {
   return NextResponse.json(data, init);
@@ -18,6 +19,14 @@ export async function enforceRateLimit(req: Request, tier: RateTier = "default")
   const key = `${tier}:${clientKey(req)}`;
   const result = await checkRateLimit(key, limit, windowMs);
   if (!result.ok) {
+    trackFromRequest(req, {
+      eventType: "rate_limit",
+      category: "abuse",
+      path: new URL(req.url).pathname,
+      method: req.method,
+      metadata: { tier, retryAfterSec: result.retryAfterSec },
+      severity: "warn",
+    });
     return bad("Rate limit exceeded — please wait and try again.", 429, {
       retryAfterSec: result.retryAfterSec,
     });

app/api/admin/observability/route.ts

@@ -0,0 +1,29 @@
+import { ok, bad, handleError, enforceRateLimit } from "../../_utils";
+import { getAppUser } from "@/lib/auth";
+import { buildObservabilityPayload } from "@/lib/analytics/aggregate";
+import { isAnalyticsConfigured } from "@/lib/supabase/admin";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+/** Admin-only observability metrics and retrospective report. */
+export async function GET(req: Request) {
+  try {
+    const limited = await enforceRateLimit(req, "default");
+    if (limited) return limited;
+
+    const user = await getAppUser();
+    if (!user || user.role !== "admin") return bad("Admin access required", 403);
+
+    const days = Math.min(90, Math.max(7, Number(new URL(req.url).searchParams.get("days") || 30)));
+    const payload = await buildObservabilityPayload(days);
+
+    return ok({
+      ...payload,
+      admin: { email: user.email },
+      schemaReady: isAnalyticsConfigured(),
+    });
+  } catch (e) {
+    return handleError(e);
+  }
+}

app/api/analytics/collect/route.ts

@@ -0,0 +1,85 @@
+import { ok, bad, safeJson, handleError, enforceRateLimit } from "../../_utils";
+import { getAppUser } from "@/lib/auth";
+import { isInternalAnalyticsRequest } from "@/lib/analytics/parse-edge";
+import { trackFromRequest } from "@/lib/analytics/track";
+import type { AnalyticsCategory, AnalyticsEventType } from "@/lib/analytics/types";
+import { createClient, isSupabaseConfigured } from "@/lib/supabase/server";
+import { isAnalyticsConfigured } from "@/lib/supabase/admin";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+type Body = {
+  eventType?: AnalyticsEventType;
+  category?: AnalyticsCategory;
+  path?: string;
+  method?: string;
+  feature?: string;
+  mode?: string;
+  metadata?: Record<string, unknown>;
+};
+
+const CLIENT_ALLOWED: AnalyticsEventType[] = [
+  "auth_failed",
+  "feature_use",
+  "signup",
+  "login",
+];
+
+/** Ingest analytics events from middleware (internal) or client (auth/feature). */
+export async function POST(req: Request) {
+  try {
+    if (!isAnalyticsConfigured()) return ok({ tracked: false, reason: "not_configured" });
+
+    const internal = isInternalAnalyticsRequest(req);
+    if (!internal) {
+      const limited = await enforceRateLimit(req, "default");
+      if (limited) return limited;
+    }
+
+    const b = await safeJson<Body>(req, "default");
+    if (!b?.eventType) return bad("eventType is required");
+
+    if (!internal && !CLIENT_ALLOWED.includes(b.eventType)) {
+      return bad("Event type not allowed from client", 403);
+    }
+
+    let userId: string | null = null;
+    if (isSupabaseConfigured() && (b.eventType === "signup" || b.eventType === "login")) {
+      const supabase = createClient();
+      const {
+        data: { user },
+      } = await supabase.auth.getUser();
+      userId = user?.id ?? null;
+    }
+
+    const category =
+      b.category ||
+      (b.eventType === "page_view"
+        ? "visit"
+        : b.eventType === "auth_failed" || b.eventType === "signup" || b.eventType === "login"
+          ? "auth"
+          : b.eventType === "rate_limit"
+            ? "abuse"
+            : "usage");
+
+    const metadata = { ...(b.metadata || {}) };
+    if (b.feature) metadata.feature = b.feature;
+    if (b.mode) metadata.mode = b.mode;
+
+    trackFromRequest(req, {
+      eventType: b.eventType,
+      category,
+      path: b.path ?? null,
+      method: b.method ?? null,
+      userId,
+      metadata,
+      severity:
+        b.eventType === "rate_limit" || b.eventType === "auth_failed" ? "warn" : "info",
+    });
+
+    return ok({ tracked: true });
+  } catch (e) {
+    return handleError(e);
+  }
+}

app/api/projects/route.ts

@@ -1,6 +1,7 @@
-import { bad, handleError, ok, safeJson } from "../_utils";
+import { bad, enforceRateLimit, handleError, ok, safeJson } from "../_utils";
 import { createClient, isSupabaseConfigured } from "@/lib/supabase/server";
 import { getAppUser } from "@/lib/auth";
+import { trackFromRequest } from "@/lib/analytics/track";
 import type { ProjectState } from "@/lib/types";
 
 export const runtime = "nodejs";
@@ -9,8 +10,10 @@ export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
 
 /** Cloud sync: load/save manuscript project for authenticated users. */
-export async function GET() {
+export async function GET(req: Request) {
   try {
+    const limited = await enforceRateLimit(req, "default");
+    if (limited) return limited;
     if (!isSupabaseConfigured()) return ok({ configured: false, project: null });
     const user = await getAppUser();
     if (!user) return bad("Sign in required for cloud sync", 401);
@@ -37,6 +40,8 @@ export async function GET() {
 
 export async function PUT(req: Request) {
   try {
+    const limited = await enforceRateLimit(req, "default");
+    if (limited) return limited;
     if (!isSupabaseConfigured()) return bad("Supabase not configured", 503);
     const user = await getAppUser();
     if (!user) return bad("Sign in required for cloud sync", 401);
@@ -73,6 +78,15 @@ export async function PUT(req: Request) {
       .single();
 
     if (error) throw error;
+
+    trackFromRequest(req, {
+      eventType: "project_sync",
+      category: "usage",
+      path: "/api/projects",
+      method: "PUT",
+      userId: user.id,
+    });
+
     return ok({ saved: true, updatedAt: data.updated_at });
   } catch (e) {
     return handleError(e);

app/api/share/route.ts

@@ -1,6 +1,7 @@
 import { bad, enforceRateLimit, handleError, ok, safeJson } from "../_utils";
-import { createClient, isSupabaseConfigured } from "@/lib/supabase/server";
+import { createClient, createServiceClient, isSupabaseConfigured } from "@/lib/supabase/server";
 import { getAppUser } from "@/lib/auth";
+import { trackFromRequest } from "@/lib/analytics/track";
 import type { ProjectState } from "@/lib/types";
 
 export const runtime = "nodejs";
@@ -56,6 +57,14 @@ export async function POST(req: Request) {
     });
     if (error) throw error;
 
+    trackFromRequest(req, {
+      eventType: "share_created",
+      category: "usage",
+      path: "/api/share",
+      userId: user?.id ?? null,
+      metadata: { anonymous: !user },
+    });
+
     const origin = originFromRequest(req);
     const url = `${origin}/?share=${token}`;
     return ok({ token, url, expiresAt });
@@ -74,9 +83,13 @@ export async function GET(req: Request) {
     if (limited) return limited;
     const token = new URL(req.url).searchParams.get("token");
     if (!token) return bad("token is required");
+    if (!/^[a-f0-9]{32,64}$/i.test(token)) return bad("invalid token", 400);
 
-    const supabase = createClient();
-    const { data, error } = await supabase
+    // Service-role read by token only — anon RLS must not allow table scans.
+    const admin = createServiceClient();
+    if (!admin) return bad("Server-stored sharing is unavailable.", 503);
+
+    const { data, error } = await admin
       .from("shared_projects")
       .select("state, expires_at")
       .eq("token", token)

app/auth/callback/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { createClient } from "@/lib/supabase/server";
 import { promoteOwnerIfNeeded } from "@/lib/auth";
+import { trackFromRequest } from "@/lib/analytics/track";
 
 export async function GET(request: Request) {
   const { searchParams, origin } = new URL(request.url);
@@ -23,6 +24,12 @@ export async function GET(request: Request) {
       } = await supabase.auth.getUser();
       if (user?.email) {
         await promoteOwnerIfNeeded(user.id, user.email);
+        trackFromRequest(request, {
+          eventType: "login",
+          category: "auth",
+          path: "/auth/callback",
+          userId: user.id,
+        });
       }
       return NextResponse.redirect(`${origin}${next}`);
     }