Fix/nextjs CVE 2025 66478

backend/supabase/migrations/20250915000000_create_feedback_table.sql

@@ -0,0 +1,33 @@
+-- Create feedback table
+CREATE TABLE public.feedback (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  conversation_id TEXT NOT NULL UNIQUE REFERENCES public.conversations(conversation_id) ON DELETE CASCADE,
+  score INTEGER NOT NULL CHECK (score >= 1 AND score <= 5),
+  summary TEXT NOT NULL,
+  strengths JSONB NOT NULL DEFAULT '[]'::jsonb,
+  areas_for_improvement JSONB NOT NULL DEFAULT '[]'::jsonb,
+  human_rating VARCHAR(20), -- For admin evaluation: 'good', 'bad', etc.
+  human_notes TEXT, -- For qualitative admin feedback
+  created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP,
+  updated_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP
+);
+
+-- Enable Row Level Security
+ALTER TABLE public.feedback ENABLE ROW LEVEL SECURITY;
+
+-- Create policy for authenticated users to read feedback
+CREATE POLICY "Users can read feedback for their conversations" ON public.feedback
+  FOR SELECT USING (
+    conversation_id IN (
+      SELECT conversation_id FROM public.conversations 
+      WHERE user_id = auth.uid()::text
+    )
+  );
+
+-- Grant access to authenticated users
+GRANT SELECT ON public.feedback TO authenticated;
+GRANT INSERT ON public.feedback TO authenticated;
+GRANT UPDATE ON public.feedback TO authenticated;
+
+-- Create index for performance
+CREATE INDEX idx_feedback_conversation_id ON public.feedback(conversation_id);

frontend/app/api/feedback/generate-feedback/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { feedbackDataSchema } from "@/types/feedback";
 import { generateFeedbackUsingLLM } from "@/lib/server/services/feedback/feedbackCompletion";
+import { supabase } from "../../init";
 
 export async function POST(req: NextRequest) {
   try {
@@ -9,6 +10,25 @@ export async function POST(req: NextRequest) {
 
     const parsedFeedback = feedbackDataSchema.parse(feedback);
 
+    // Save feedback to database
+    const { data, error } = await supabase
+      .from("feedback")
+      .upsert({
+        conversation_id: body.conversationId,
+        score: parsedFeedback.score,
+        summary: parsedFeedback.summary,
+        strengths: parsedFeedback.strengths,
+        areas_for_improvement: parsedFeedback.areas_for_improvement,
+        updated_at: new Date().toISOString()
+      })
+      .select()
+      .single();
+
+    if (error) {
+      console.error("Error saving feedback:", error);
+      // Still return the feedback even if saving fails
+    }
+
     return NextResponse.json(parsedFeedback, { status: 200 });
   } catch (error) {
     console.error("Error generating feedback:", error);

frontend/package.json

@@ -30,7 +30,7 @@
     "jspdf": "^2.5.2",
     "lodash": "^4.17.21",
     "lucide-react": "^0.473.0",
-    "next": "^15.0.1",
+    "next": "^15.2.6",
     "openai": "^4.67.3",
     "react": "^18",
     "react-dom": "^18",