From c8021495a1025c42a53d279101bd0694f02d1563 Mon Sep 17 00:00:00 2001
From: BizzleBot <bizzlebot@bizzle.lol>
Date: Thu, 19 Feb 2026 06:19:05 +0000
Subject: [PATCH] security: add future date guard to entry validation

- Zod refine rejects dates beyond today in createEntrySchema
- Per-day 24h hour cap already in entries.js (prev commit)
- totalHours populated in history endpoint (prev commit)
- Removed duplicate security headers from nginx (Caddy handles)
---
 backend/src/utils/validation.js | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/backend/src/utils/validation.js b/backend/src/utils/validation.js
index 6f1e5df..bf99012 100644
--- a/backend/src/utils/validation.js
+++ b/backend/src/utils/validation.js
@@ -26,8 +26,11 @@ const refreshSchema = z.object({
 const createEntrySchema = z.object({
   date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/, 'Date must be YYYY-MM-DD')
     .refine(val => {
-      const entryDate = new Date(val + 'T23:59:59Z');
-      return entryDate <= new Date();
+      // Allow today + past dates. Compare date-only (ignore time).
+      // Use T12:00 to avoid timezone edge cases.
+      const today = new Date();
+      const todayStr = today.toISOString().split('T')[0];
+      return val <= todayStr;
     }, { message: 'Cannot create entries for future dates' }),
   homeownerId: z.string().uuid('Invalid homeowner ID'),
   hoursWorked: z