bizzle/coastal_timesheet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: add future date guard to entry validation

Browse Source 
- Zod refine rejects dates beyond today in createEntrySchema
- Per-day 24h hour cap already in entries.js (prev commit)
- totalHours populated in history endpoint (prev commit)
- Removed duplicate security headers from nginx (Caddy handles)
This commit is contained in:
BizzleBot
2026-02-19 06:19:05 +00:00
parent a0234cdd31
commit c8021495a1
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/utils/validation.js
+5 -2
View File
@@ -26,8 +26,11 @@ const refreshSchema = z.object({
const createEntrySchema = z.object({ const createEntrySchema = z.object({
date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/, 'Date must be YYYY-MM-DD') date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/, 'Date must be YYYY-MM-DD')
.refine(val => { .refine(val => {
const entryDate = new Date(val + 'T23:59:59Z'); // Allow today + past dates. Compare date-only (ignore time).
return entryDate <= new Date(); // Use T12:00 to avoid timezone edge cases.
const today = new Date();
const todayStr = today.toISOString().split('T')[0];
return val <= todayStr;
}, { message: 'Cannot create entries for future dates' }), }, { message: 'Cannot create entries for future dates' }),
homeownerId: z.string().uuid('Invalid homeowner ID'), homeownerId: z.string().uuid('Invalid homeowner ID'),
hoursWorked: z hoursWorked: z