Implement OWASP ASVS L1 security remediation (Phases 0-2)

Auth: Add requireAuth/requireAdmin guards with JWT cookie verification,
member status checks (suspended/cancelled = 403), and admin role
enforcement. Apply to all admin, upload, and payment endpoints. Add
role field to Member model.

CSRF: Double-submit cookie middleware with client plugin. Exempt
webhook and magic-link verify routes.

Headers: X-Content-Type-Options, X-Frame-Options, X-XSS-Protection,
Referrer-Policy, Permissions-Policy on all responses. HSTS and CSP
(Helcim/Cloudinary/Plausible sources) in production only.

Rate limiting: Auth 5/5min, payment 10/min, upload 10/min, general
100/min via rate-limiter-flexible, keyed by client IP.

XSS: DOMPurify sanitization on marked() output with tag/attr
allowlists. escapeHtml() utility for email template interpolation.

Anti-enumeration: Login returns identical response for existing and
non-existing emails. Remove 404 handling from login UI components.

Mass assignment: Remove helcimCustomerId from profile allowedFields.

Session: 7-day token expiry, refresh endpoint, httpOnly+secure cookies.

Environment: Validate required secrets on startup via server plugin.
Remove JWT_SECRET hardcoded fallback.

server/api/auth/login.post.js

@@ -19,19 +19,23 @@ export default defineEventHandler(async (event) => {
     });
   }
 
+  const GENERIC_MESSAGE = "If this email is registered, we've sent a login link.";
+
   const member = await Member.findOne({ email });
+
   if (!member) {
-    throw createError({
-      statusCode: 404,
-      statusMessage: "No account found with that email address",
-    });
+    // Return same response shape to prevent enumeration
+    return {
+      success: true,
+      message: GENERIC_MESSAGE,
+    };
   }
 
   // Generate magic link token
   const token = jwt.sign(
     { memberId: member._id },
     process.env.JWT_SECRET,
-    { expiresIn: "15m" }, // Shorter expiry for security
+    { expiresIn: "15m" },
   );
 
   // Get the base URL for the magic link
@@ -65,7 +69,7 @@ export default defineEventHandler(async (event) => {
 
     return {
       success: true,
-      message: "Login link sent to your email",
+      message: GENERIC_MESSAGE,
     };
   } catch (error) {
     console.error("Failed to send email:", error);

server/api/auth/member.get.js

@@ -1,60 +1,30 @@
-import jwt from "jsonwebtoken";
-import Member from "../../models/member.js";
-import { connectDB } from "../../utils/mongoose.js";
+import { requireAuth } from "../../utils/auth.js";
 
 export default defineEventHandler(async (event) => {
-  await connectDB();
+  const member = await requireAuth(event);
 
-  const token = getCookie(event, "auth-token");
-  console.log("Auth check - token found:", !!token);
-
-  if (!token) {
-    console.log("No auth token found in cookies");
-    throw createError({
-      statusCode: 401,
-      statusMessage: "Not authenticated",
-    });
-  }
-
-  try {
-    const decoded = jwt.verify(token, process.env.JWT_SECRET);
-    const member = await Member.findById(decoded.memberId).select("-__v");
-
-    if (!member) {
-      throw createError({
-        statusCode: 404,
-        statusMessage: "Member not found",
-      });
-    }
-
-    return {
-      _id: member._id,
-      id: member._id,
-      email: member.email,
-      name: member.name,
-      circle: member.circle,
-      contributionTier: member.contributionTier,
-      membershipLevel: `${member.circle}-${member.contributionTier}`,
-      // Profile fields
-      pronouns: member.pronouns,
-      timeZone: member.timeZone,
-      avatar: member.avatar,
-      studio: member.studio,
-      bio: member.bio,
-      location: member.location,
-      socialLinks: member.socialLinks,
-      offering: member.offering,
-      lookingFor: member.lookingFor,
-      showInDirectory: member.showInDirectory,
-      privacy: member.privacy,
-      // Peer support
-      peerSupport: member.peerSupport,
-    };
-  } catch (err) {
-    console.error("Token verification error:", err);
-    throw createError({
-      statusCode: 401,
-      statusMessage: "Invalid or expired token",
-    });
-  }
+  return {
+    _id: member._id,
+    id: member._id,
+    email: member.email,
+    name: member.name,
+    role: member.role || 'member',
+    circle: member.circle,
+    contributionTier: member.contributionTier,
+    membershipLevel: `${member.circle}-${member.contributionTier}`,
+    // Profile fields
+    pronouns: member.pronouns,
+    timeZone: member.timeZone,
+    avatar: member.avatar,
+    studio: member.studio,
+    bio: member.bio,
+    location: member.location,
+    socialLinks: member.socialLinks,
+    offering: member.offering,
+    lookingFor: member.lookingFor,
+    showInDirectory: member.showInDirectory,
+    privacy: member.privacy,
+    // Peer support
+    peerSupport: member.peerSupport,
+  };
 });

server/api/auth/refresh.post.js

@@ -0,0 +1,58 @@
+import jwt from 'jsonwebtoken'
+import Member from '../../models/member.js'
+import { connectDB } from '../../utils/mongoose.js'
+
+export default defineEventHandler(async (event) => {
+  await connectDB()
+
+  const token = getCookie(event, 'auth-token')
+
+  if (!token) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: 'Not authenticated'
+    })
+  }
+
+  let decoded
+  try {
+    decoded = jwt.verify(token, useRuntimeConfig().jwtSecret)
+  } catch (err) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: 'Invalid or expired token'
+    })
+  }
+
+  const member = await Member.findById(decoded.memberId)
+
+  if (!member) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: 'Member not found'
+    })
+  }
+
+  if (member.status === 'suspended' || member.status === 'cancelled') {
+    throw createError({
+      statusCode: 403,
+      statusMessage: 'Account is ' + member.status
+    })
+  }
+
+  // Issue a fresh token
+  const newToken = jwt.sign(
+    { memberId: member._id, email: member.email },
+    useRuntimeConfig().jwtSecret,
+    { expiresIn: '7d' }
+  )
+
+  setCookie(event, 'auth-token', newToken, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax',
+    maxAge: 60 * 60 * 24 * 7 // 7 days
+  })
+
+  return { success: true }
+})

server/api/auth/status.get.js

@@ -6,8 +6,6 @@ export default defineEventHandler(async (event) => {
   await connectDB()
   
   const token = getCookie(event, 'auth-token')
-  console.log('🔍 Auth status check - token exists:', !!token)
-  
   if (!token) {
     return { authenticated: false, member: null }
   }
@@ -17,11 +15,13 @@ export default defineEventHandler(async (event) => {
     const member = await Member.findById(decoded.memberId).select('-__v')
     
     if (!member) {
-      console.log('⚠️ Token valid but member not found')
       return { authenticated: false, member: null }
     }
-    
-    console.log('✅ Auth status check - member found:', member.email)
+
+    if (member.status === 'suspended' || member.status === 'cancelled') {
+      return { authenticated: false, member: null, reason: 'account_' + member.status }
+    }
+
     return { 
       authenticated: true, 
       member: {
@@ -34,7 +34,6 @@ export default defineEventHandler(async (event) => {
       }
     }
   } catch (err) {
-    console.error('❌ Auth status check - token verification failed:', err.message)
     return { authenticated: false, member: null }
   }
 })

server/api/auth/verify.get.js

@@ -33,22 +33,21 @@ export default defineEventHandler(async (event) => {
     const sessionToken = jwt.sign(
       { memberId: member._id, email: member.email },
       process.env.JWT_SECRET,
-      { expiresIn: '30d' }
+      { expiresIn: '7d' }
     )
-    
+
     // Set the session cookie
     setCookie(event, 'auth-token', sessionToken, {
-      httpOnly: false, // Allow JavaScript access for debugging in development
-      secure: false, // Don't require HTTPS in development
+      httpOnly: true,
+      secure: process.env.NODE_ENV === 'production',
       sameSite: 'lax',
-      maxAge: 60 * 60 * 24 * 30 // 30 days
+      maxAge: 60 * 60 * 24 * 7 // 7 days
     })
     
     // Redirect to the members dashboard or home page
     await sendRedirect(event, '/members', 302)
     
   } catch (err) {
-    console.error('Token verification error:', err)
     throw createError({ 
       statusCode: 401, 
       statusMessage: 'Invalid or expired token'