MDM-VPN-Pivot (Phase F.2 done): - ops/mdm/profiles/rebreak-iphone-protection.mobileconfig auf v5 mit com.apple.vpn.managed Payload + OnDemandUserOverrideDisabled. iPhone-User kann ReBreak-VPN-Profile nicht entfernen und "Bedarf verbinden"-Toggle ist disabled. allowEnablingRestrictions empirisch widerlegt für FC-Toggle- Lock — out. - DEV-removable Variante als Test-Profile dazu. - Bootstrap-Tool (rebreak-supervise.sh) + Supervision-Identity-Setup-Doc. - PHASES.md updated mit empirischen Befunden. App-side MDM-Detect (Pfad-a Banner-Logic): - modules/rebreak-protection: getDeviceState() returnt mdmManaged via Heuristik NETunnelProviderManager.count > 1 (App selbst kann nur einen eigenen erstellen, MDM-Push fügt einen zweiten hinzu). - DeviceLayers.mdmManaged?: boolean Type. - blocker.tsx: lockedIn-Bedingung erweitert um mdmManaged. Bei MDM-managed iPhones wird der App-Lock-Card (FC-Authorization-Toggle UI) ausgeblendet weil der per-App FC-Toggle nicht lockbar ist und durch den MDM-VPN-Layer redundant. Layer-2-Country-Curated-Pivot: - backend: vip-swap.post.ts raus, suggest.post.ts rein. Curated-domains durch admin (separate Tabelle/Pfad), getrennt von User-Custom-Domains. - Admin-APIs für curated-domain Pflege (index.get + [id].patch). - seed-country-blocklists Script für initiale Curated-Domain-Liste. - protection/webcontent-domains.get refactored für Country-Curated-Pfad. - Migration drop_vip_swap_fields.sql + schema.prisma adjusted. - docs/concepts/layer2-country-pivot.md mit Architektur + Decision-Trail. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
54 lines
1.6 KiB
TypeScript
54 lines
1.6 KiB
TypeScript
import { usePrisma } from "../../utils/prisma";
|
|
import { suggestCuratedDomain } from "../../db/curatedDomains";
|
|
|
|
// Unterstützte Ländercodes für Layer-2-Listen
|
|
const SUPPORTED_COUNTRIES = ["DE", "GB", "FR", "TN"] as const;
|
|
type SupportedCountry = (typeof SUPPORTED_COUNTRIES)[number];
|
|
|
|
// Regex: Domain muss mindestens eine TLD haben
|
|
const DOMAIN_RE =
|
|
/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
|
|
|
|
/**
|
|
* POST /api/custom-domains/suggest
|
|
*
|
|
* User schlägt eine Domain für die Country-Curated-Layer-2-Liste vor.
|
|
* Erstellt einen CuratedDomain-Eintrag mit status="suggested".
|
|
* Admin entscheidet via PATCH /api/admin/curated-domains/[id] (approve/reject).
|
|
*
|
|
* Body: { domain: string, country: string }
|
|
*
|
|
* Response:
|
|
* { ok: true, id: string, domain: string, country: string }
|
|
* oder 409 wenn domain+country-Kombination bereits existiert
|
|
*/
|
|
export default defineEventHandler(async (event) => {
|
|
const user = await requireUser(event);
|
|
const body = await readBody(event);
|
|
|
|
const rawDomain = (body?.domain as string)?.trim().toLowerCase() ?? "";
|
|
const rawCountry = (body?.country as string)?.trim().toUpperCase() ?? "";
|
|
|
|
if (!rawDomain || !DOMAIN_RE.test(rawDomain)) {
|
|
throw createError({ statusCode: 400, data: { error: "INVALID_DOMAIN" } });
|
|
}
|
|
|
|
if (!(SUPPORTED_COUNTRIES as readonly string[]).includes(rawCountry)) {
|
|
throw createError({
|
|
statusCode: 400,
|
|
data: {
|
|
error: "INVALID_COUNTRY",
|
|
supported: SUPPORTED_COUNTRIES,
|
|
},
|
|
});
|
|
}
|
|
|
|
const result = await suggestCuratedDomain(
|
|
user.id,
|
|
rawDomain,
|
|
rawCountry as SupportedCountry,
|
|
);
|
|
|
|
return { ok: true, ...result };
|
|
});
|