Fix security and correctness issues found in full-codebase audit

- Restrict meetingPassword field so it isn't leaked via the public REST/GraphQL API
- Fix booking slot computation to use Europe/Berlin time instead of the server's UTC clock
- Reset email verification when a customer changes their email address
- Fix ICS calendar injection via unescaped carriage returns in event descriptions
- Bind WebRTC meeting kicks to a persistent client id so they survive a rejoin
- Move the meeting signaling token out of the WebSocket query string into the first message
- Prevent duplicate signaling connections from leaking when the same participant reconnects
- Use the rightmost X-Forwarded-For entry for rate limiting (single trusted reverse proxy)
- Use constant-time comparison for the cron endpoint's bearer token
- Remove SVG from allowed Media upload types (stored-XSS risk, unused anyway)
- Add baseline security headers and a CSP to next.config.ts
- Fix CI/CD script injection via unsanitized git ref names in release.yml

.gitea/workflows/ci.yml

@@ -23,6 +23,7 @@ jobs:
       DATABASE_URI: postgresql://ci:ci@localhost:5432/ci
       PAYLOAD_SECRET: ci-only-not-a-real-secret
       MEETING_SESSION_SECRET: ci-only-not-a-real-secret
+      ANALYTICS_SALT_SECRET: ci-only-not-a-real-secret
       CRON_SECRET: ci-only-not-a-real-secret
       NEXT_PUBLIC_SERVER_URL: http://localhost:3000
     steps:

.gitea/workflows/release.yml

@@ -19,6 +19,7 @@ jobs:
       DATABASE_URI: postgresql://ci:ci@localhost:5432/ci
       PAYLOAD_SECRET: ci-only-not-a-real-secret
       MEETING_SESSION_SECRET: ci-only-not-a-real-secret
+      ANALYTICS_SALT_SECRET: ci-only-not-a-real-secret
       CRON_SECRET: ci-only-not-a-real-secret
       NEXT_PUBLIC_SERVER_URL: http://localhost:3000
     steps:
@@ -67,27 +68,43 @@ jobs:
         # so step commands use the same $GITHUB_OUTPUT / $GITHUB_ENV
         # mechanism (the `gitea.*` vs `github.*` expression contexts are
         # just aliases of each other for `${{ }}` templating).
+        #
+        # The tag name (github.ref_name / $GITHUB_REF_NAME) is
+        # attacker-influenced: anyone with tag-push rights controls it, and
+        # git allows shell metacharacters in tag names. It's read here via
+        # the automatic $GITHUB_REF_NAME env var rather than `${{ github.ref_name }}`
+        # so its value reaches bash as data (argv/envp), never spliced into
+        # the script text — `${{ }}` expressions are substituted into the
+        # YAML before bash ever sees the script, which is what makes
+        # interpolating attacker-controlled values that way a script-injection
+        # vector (arbitrary code execution in a job that holds the registry
+        # and production deploy credentials).
         run: |
           echo "registry=${REGISTRY:-git.maro.run}" >> "$GITHUB_OUTPUT"
           echo "repo=${REGISTRY_REPO:-maro/anouma}" >> "$GITHUB_OUTPUT"
-          echo "version=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          echo "version=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
         env:
           REGISTRY: git.maro.run
           REGISTRY_REPO: maro/anouma
 
       - name: Log in to registry
-        run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ steps.image.outputs.registry }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+        env:
+          REGISTRY_IMAGE: ${{ steps.image.outputs.registry }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_IMAGE" -u "$REGISTRY_USERNAME" --password-stdin
 
       - name: Build image
-        run: |
-          IMAGE="${{ steps.image.outputs.registry }}/${{ steps.image.outputs.repo }}"
-          VERSION="${{ steps.image.outputs.version }}"
-          docker build -t "$IMAGE:$VERSION" -t "$IMAGE:latest" .
+        env:
+          IMAGE: ${{ steps.image.outputs.registry }}/${{ steps.image.outputs.repo }}
+          VERSION: ${{ steps.image.outputs.version }}
+        run: docker build -t "$IMAGE:$VERSION" -t "$IMAGE:latest" .
 
       - name: Push image
+        env:
+          IMAGE: ${{ steps.image.outputs.registry }}/${{ steps.image.outputs.repo }}
+          VERSION: ${{ steps.image.outputs.version }}
         run: |
-          IMAGE="${{ steps.image.outputs.registry }}/${{ steps.image.outputs.repo }}"
-          VERSION="${{ steps.image.outputs.version }}"
           docker push "$IMAGE:$VERSION"
           docker push "$IMAGE:latest"