task-l.3

src/app/api/crm/quotations/[id]/pdf-preview/route.ts

@@ -1,5 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { generateQuotationPreviewPdf } from '@/features/foundation/pdf-generator/server/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext,
+  canViewQuotationPricing
+} from '@/features/crm/security/server/service';
 import { PERMISSIONS } from '@/lib/auth/rbac';
 import { AuthError, requireOrganizationAccess } from '@/lib/auth/session';
 
@@ -10,9 +15,27 @@ type Params = {
 export async function GET(_request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmQuotationPdfPreview
     });
+    const securityContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+
+    if (!canViewQuotationPricing(securityContext)) {
+      await auditCrmSecurityEvent({
+        organizationId: organization.id,
+        userId: session.user.id,
+        action: 'pricing_hidden',
+        entityType: 'crm_quotation',
+        entityId: id,
+        reason: 'Quotation PDF preview requires pricing visibility'
+      });
+      return NextResponse.json({ message: 'Forbidden' }, { status: 403 });
+    }
+
     const pdf = await generateQuotationPreviewPdf(id, organization.id);
 
     return new NextResponse(pdf.buffer, {