feat: complete v0.5 operations foundation

app/api/sources/[id]/manage/route.ts

@@ -5,10 +5,11 @@ import { db } from "@/lib/db";
 import { externalUrl } from "@/lib/http";
 import { getMemosIdentity, verifyMemos } from "@/lib/memos";
 import { queuePull } from "@/lib/sync";
+import { requireSameOrigin } from "@/lib/security";
 
 export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
   try {
-    const user = await requireUser(); const { id: rawId } = await params; const id = Number(rawId); const form = await req.formData(); const action = String(form.get("action") || "");
+    requireSameOrigin(req); const user = await requireUser(); const { id: rawId } = await params; const id = Number(rawId); const form = await req.formData(); const action = String(form.get("action") || "");
     const source = db.prepare("SELECT id,user_id,base_url,token_encrypted FROM sources WHERE id=?").get(id) as { id: number; user_id: number; base_url: string; token_encrypted: string } | undefined;
     const member = db.prepare("SELECT role FROM source_members WHERE source_id=? AND user_id=?").get(id, user.id);
     if (!source || !member) throw new Error("Source not found");

app/api/sources/[id]/webhook/route.ts

@@ -2,10 +2,11 @@ import { NextResponse } from "next/server";
 import { requireUser } from "@/lib/auth";
 import { db } from "@/lib/db";
 import { createWebhookSecret, webhookSecretHash } from "@/lib/webhook";
+import { requireSameOrigin } from "@/lib/security";
 
 export async function POST(request: Request, { params }: { params: Promise<{ id: string }> }) {
   try {
-    const user = await requireUser(); const { id: rawId } = await params; const id = Number(rawId);
+    requireSameOrigin(request); const user = await requireUser(); const { id: rawId } = await params; const id = Number(rawId);
     const source = db.prepare("SELECT id FROM sources WHERE id=? AND user_id=?").get(id, user.id);
     if (!source) return NextResponse.json({ error: "Not found" }, { status: 404 });
     const secret = createWebhookSecret();