From fdc9919381f9ed324df5f2551f4f711a5522f701 Mon Sep 17 00:00:00 2001 From: lorentz Date: Sat, 11 Jul 2026 09:46:20 -0400 Subject: [PATCH] feat(13-02): gate POST /api/pax8/sync on the disabled toggle - Return 403 when integration_settings.key='pax8' has disabled=true - Check runs as the first statement, before isSyncInProgress() - GET handler unchanged; no new imports (postgresClient already imported) --- app/api/pax8/sync/route.ts | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/app/api/pax8/sync/route.ts b/app/api/pax8/sync/route.ts index 60ae938..94b3a30 100644 --- a/app/api/pax8/sync/route.ts +++ b/app/api/pax8/sync/route.ts @@ -3,6 +3,16 @@ import { getPax8SyncService } from '@/lib/services/pax8-sync-service'; import postgresClient from '@/lib/services/postgres-client'; export async function POST(req: NextRequest) { + const disabledRes = await postgresClient.query<{ disabled: boolean }>( + `SELECT disabled FROM integration_settings WHERE key = 'pax8'` + ); + if (disabledRes.rows[0]?.disabled === true) { + return NextResponse.json( + { error: 'PAX8 is disabled', message: 'PAX8 sync is disabled via /admin/integrations' }, + { status: 403 } + ); + } + const body = await req.json().catch(() => ({})); const triggeredBy = body.triggeredBy || 'manual';