Fix security and correctness issues found in full-codebase audit

- Restrict meetingPassword field so it isn't leaked via the public REST/GraphQL API
- Fix booking slot computation to use Europe/Berlin time instead of the server's UTC clock
- Reset email verification when a customer changes their email address
- Fix ICS calendar injection via unescaped carriage returns in event descriptions
- Bind WebRTC meeting kicks to a persistent client id so they survive a rejoin
- Move the meeting signaling token out of the WebSocket query string into the first message
- Prevent duplicate signaling connections from leaking when the same participant reconnects
- Use the rightmost X-Forwarded-For entry for rate limiting (single trusted reverse proxy)
- Use constant-time comparison for the cron endpoint's bearer token
- Remove SVG from allowed Media upload types (stored-XSS risk, unused anyway)
- Add baseline security headers and a CSP to next.config.ts
- Fix CI/CD script injection via unsanitized git ref names in release.yml

lib/meeting/protocol.ts

@@ -7,6 +7,7 @@ export type ParticipantSummary = {
 };
 
 export type ClientToServerMessage =
+  | { type: "auth"; token: string }
   | { type: "offer"; to: string; payload: RTCSessionDescriptionInit }
   | { type: "answer"; to: string; payload: RTCSessionDescriptionInit }
   | { type: "ice-candidate"; to: string; payload: RTCIceCandidateInit }
@@ -19,4 +20,5 @@ export type ServerToClientMessage =
   | { type: "offer"; from: string; payload: RTCSessionDescriptionInit }
   | { type: "answer"; from: string; payload: RTCSessionDescriptionInit }
   | { type: "ice-candidate"; from: string; payload: RTCIceCandidateInit }
-  | { type: "kicked" };
+  | { type: "kicked" }
+  | { type: "auth-error"; reason: string };

lib/meeting/rooms.ts

@@ -4,6 +4,7 @@ import type { MeetingRole } from "./token";
 export type Participant = {
   ws: WebSocket;
   participantId: string;
+  clientId?: string;
   name: string;
   role: MeetingRole;
 };
@@ -11,6 +12,11 @@ export type Participant = {
 type Room = {
   participants: Map<string, Participant>;
   kickedParticipantIds: Set<string>;
+  // Keyed by the client-declared, localStorage-persisted clientId (see
+  // token.ts) rather than the per-connection participantId, so a kick
+  // survives the participant simply reconnecting (which always mints a
+  // fresh participantId) — see isKicked below.
+  kickedClientIds: Set<string>;
 };
 
 // In-memory only — this server process is the single source of truth for
@@ -22,19 +28,27 @@ const rooms = new Map<string, Room>();
 function getOrCreateRoom(eventSlug: string): Room {
   let room = rooms.get(eventSlug);
   if (!room) {
-    room = { participants: new Map(), kickedParticipantIds: new Set() };
+    room = { participants: new Map(), kickedParticipantIds: new Set(), kickedClientIds: new Set() };
     rooms.set(eventSlug, room);
   }
   return room;
 }
 
-export function isKicked(eventSlug: string, participantId: string): boolean {
-  return rooms.get(eventSlug)?.kickedParticipantIds.has(participantId) ?? false;
+export function isKicked(eventSlug: string, participantId: string, clientId?: string): boolean {
+  const room = rooms.get(eventSlug);
+  if (!room) return false;
+  if (room.kickedParticipantIds.has(participantId)) return true;
+  return clientId ? room.kickedClientIds.has(clientId) : false;
 }
 
 export function joinRoom(eventSlug: string, participant: Participant): Participant[] {
   const room = getOrCreateRoom(eventSlug);
   const existing = [...room.participants.values()];
+  // Two connections claiming the same participantId (e.g. two tabs replaying
+  // the same stored session) would otherwise silently overwrite the map
+  // entry here and orphan the first socket — close it first so it doesn't
+  // leak as an unreachable broadcast target.
+  room.participants.get(participant.participantId)?.ws.close(4002, "replaced-by-new-connection");
   room.participants.set(participant.participantId, participant);
   return existing;
 }
@@ -50,6 +64,8 @@ export function kickFromRoom(eventSlug: string, participantId: string) {
   const room = rooms.get(eventSlug);
   if (!room) return;
   room.kickedParticipantIds.add(participantId);
+  const target = room.participants.get(participantId);
+  if (target?.clientId) room.kickedClientIds.add(target.clientId);
   room.participants.delete(participantId);
 }
 

lib/meeting/signalingServer.ts

@@ -1,4 +1,3 @@
-import type { IncomingMessage } from "node:http";
 import type { WebSocket, WebSocketServer } from "ws";
 import { verifyMeetingToken } from "./token";
 import {
@@ -12,46 +11,61 @@ import {
 } from "./rooms";
 import type { ClientToServerMessage, ParticipantSummary } from "./protocol";
 
+// A connection has this long to send its "auth" message before being
+// dropped. The token travels as the first WS message rather than a
+// `?token=` query parameter so it doesn't end up persisted in reverse-proxy
+// or access logs; it's still HMAC-signed and short-lived either way.
+const AUTH_TIMEOUT_MS = 10_000;
+
 function participantSummary(p: Participant): ParticipantSummary {
   return { participantId: p.participantId, name: p.name, role: p.role };
 }
 
 export function attachSignalingServer(wss: WebSocketServer) {
-  wss.on("connection", (ws: WebSocket, req: IncomingMessage) => {
-    const url = new URL(req.url ?? "", "http://internal");
-    const token = url.searchParams.get("token") ?? "";
-    const payload = verifyMeetingToken(token);
+  wss.on("connection", (ws: WebSocket) => {
+    let self: Participant | null = null;
+    let eventSlug: string | null = null;
 
-    if (!payload) {
-      ws.close(4000, "invalid-token");
-      return;
+    const authTimeout = setTimeout(() => {
+      if (!self) ws.close(4000, "auth-timeout");
+    }, AUTH_TIMEOUT_MS);
+
+    function handleAuth(token: string) {
+      const payload = verifyMeetingToken(token);
+      if (!payload) {
+        ws.send(JSON.stringify({ type: "auth-error", reason: "invalid-token" }));
+        ws.close(4000, "invalid-token");
+        return;
+      }
+      if (isKicked(payload.eventSlug, payload.participantId, payload.clientId)) {
+        ws.close(4001, "removed-by-host");
+        return;
+      }
+
+      eventSlug = payload.eventSlug;
+      self = {
+        ws,
+        participantId: payload.participantId,
+        clientId: payload.clientId,
+        name: payload.name,
+        role: payload.role,
+      };
+
+      const existing = joinRoom(eventSlug, self);
+
+      ws.send(
+        JSON.stringify({
+          type: "welcome",
+          participantId: self.participantId,
+          role: self.role,
+          participants: existing.map(participantSummary),
+        }),
+      );
+
+      broadcast(eventSlug, { type: "peer-joined", ...participantSummary(self) }, {
+        exclude: self.participantId,
+      });
     }
-    if (isKicked(payload.eventSlug, payload.participantId)) {
-      ws.close(4001, "removed-by-host");
-      return;
-    }
-
-    const self: Participant = {
-      ws,
-      participantId: payload.participantId,
-      name: payload.name,
-      role: payload.role,
-    };
-
-    const existing = joinRoom(payload.eventSlug, self);
-
-    ws.send(
-      JSON.stringify({
-        type: "welcome",
-        participantId: self.participantId,
-        role: self.role,
-        participants: existing.map(participantSummary),
-      }),
-    );
-
-    broadcast(payload.eventSlug, { type: "peer-joined", ...participantSummary(self) }, {
-      exclude: self.participantId,
-    });
 
     ws.on("message", (raw) => {
       let message: ClientToServerMessage;
@@ -61,8 +75,17 @@ export function attachSignalingServer(wss: WebSocketServer) {
         return;
       }
 
+      if (message.type === "auth") {
+        clearTimeout(authTimeout);
+        if (self) return; // already authenticated on this connection
+        handleAuth(message.token);
+        return;
+      }
+
+      if (!self || !eventSlug) return; // no messages accepted before auth
+
       if (message.type === "offer" || message.type === "answer" || message.type === "ice-candidate") {
-        const target = getParticipant(payload.eventSlug, message.to);
+        const target = getParticipant(eventSlug, message.to);
         if (target && target.ws.readyState === target.ws.OPEN) {
           target.ws.send(
             JSON.stringify({ type: message.type, from: self.participantId, payload: message.payload }),
@@ -73,18 +96,20 @@ export function attachSignalingServer(wss: WebSocketServer) {
 
       if (message.type === "kick") {
         if (self.role !== "host") return; // server-side authority, not client-claimed
-        const target = getParticipant(payload.eventSlug, message.targetParticipantId);
+        const target = getParticipant(eventSlug, message.targetParticipantId);
         if (!target) return;
-        kickFromRoom(payload.eventSlug, target.participantId);
+        kickFromRoom(eventSlug, target.participantId);
         target.ws.send(JSON.stringify({ type: "kicked" }));
         target.ws.close(4001, "removed-by-host");
-        broadcast(payload.eventSlug, { type: "peer-left", participantId: target.participantId });
+        broadcast(eventSlug, { type: "peer-left", participantId: target.participantId });
       }
     });
 
     ws.on("close", () => {
-      leaveRoom(payload.eventSlug, self.participantId);
-      broadcast(payload.eventSlug, { type: "peer-left", participantId: self.participantId });
+      clearTimeout(authTimeout);
+      if (!self || !eventSlug) return;
+      leaveRoom(eventSlug, self.participantId);
+      broadcast(eventSlug, { type: "peer-left", participantId: self.participantId });
     });
   });
 }

lib/meeting/token.ts

@@ -5,6 +5,16 @@ export type MeetingRole = "host" | "participant";
 export type MeetingTokenPayload = {
   eventSlug: string;
   participantId: string;
+  // Self-declared, persisted client-side (localStorage, not sessionStorage)
+  // identity for participants — participantId is fresh per /join call, so
+  // without this a kick could always be undone by simply rejoining. Only
+  // used to make a kick stick across a rejoin (see rooms.ts kickedClientIds);
+  // never used to key live room membership, so a client choosing an
+  // arbitrary/colliding value can only affect their own future kick status,
+  // never another participant's connection. Still bypassable by clearing
+  // localStorage or joining from a different browser — there's no real
+  // identity to anchor to for an unauthenticated participant.
+  clientId?: string;
   name: string;
   role: MeetingRole;
   exp: number; // unix ms
@@ -29,12 +39,18 @@ export function createMeetingToken(args: {
   eventSlug: string;
   name: string;
   role: MeetingRole;
+  clientId?: string;
   ttlMs?: number;
 }): { token: string; participantId: string } {
   const participantId = randomUUID();
+  const clientId =
+    typeof args.clientId === "string" && args.clientId.length > 0 && args.clientId.length <= 100
+      ? args.clientId
+      : undefined;
   const payload: MeetingTokenPayload = {
     eventSlug: args.eventSlug,
     participantId,
+    clientId,
     name: args.name,
     role: args.role,
     exp: Date.now() + (args.ttlMs ?? 6 * 60 * 60 * 1000), // 6h default