feat: comprehensive application audit and fixes

Audited codebase, fixed input validation, OAuth, error handling, type casts, and security hardening

Co-authored-by: Moheeb Zara <[email protected]>

app/(app)/error.tsx

@@ -0,0 +1,61 @@
+'use client'
+
+import { useEffect } from 'react'
+import { AlertTriangle, RefreshCw, ArrowLeft } from 'lucide-react'
+import Link from 'next/link'
+
+export default function AppError({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string }
+  reset: () => void
+}) {
+  useEffect(() => {
+    console.error('[App Section Error]', error)
+  }, [error])
+
+  return (
+    <div className="flex-1 flex items-center justify-center p-8">
+      <div className="max-w-md w-full">
+        <div className="bg-card border border-border rounded-lg p-6 text-center">
+          <div className="w-12 h-12 rounded-full bg-destructive/10 flex items-center justify-center mx-auto mb-4">
+            <AlertTriangle className="w-6 h-6 text-destructive" />
+          </div>
+          
+          <h2 className="text-lg font-semibold text-foreground mb-2">
+            Something went wrong
+          </h2>
+          
+          <p className="text-sm text-muted-foreground mb-4">
+            We encountered an error while loading this page.
+          </p>
+
+          {error.digest && (
+            <p className="text-xs text-muted-foreground/60 font-mono mb-4 bg-muted px-2 py-1 rounded inline-block">
+              {error.digest}
+            </p>
+          )}
+
+          <div className="flex gap-2 justify-center">
+            <button
+              onClick={reset}
+              className="inline-flex items-center gap-1.5 px-3 py-2 rounded-md bg-primary text-primary-foreground text-sm font-medium hover:bg-primary/90 transition-colors"
+            >
+              <RefreshCw className="w-3.5 h-3.5" />
+              Retry
+            </button>
+            
+            <Link
+              href="/dashboard"
+              className="inline-flex items-center gap-1.5 px-3 py-2 rounded-md border border-border text-foreground text-sm font-medium hover:bg-accent transition-colors"
+            >
+              <ArrowLeft className="w-3.5 h-3.5" />
+              Dashboard
+            </Link>
+          </div>
+        </div>
+      </div>
+    </div>
+  )
+}

app/(app)/layout.tsx

@@ -41,7 +41,7 @@ export default async function AppLayout({ children }: { children: React.ReactNod
   return (
     <div className="flex h-screen bg-background overflow-hidden">
       <AppSidebar
-        member={member as any}
+        member={member}
         taskBadge={taskCount ?? 0}
         paymentBadge={paymentCount ?? 0}
       />

app/(app)/loading.tsx

@@ -0,0 +1,12 @@
+import { Loader2 } from 'lucide-react'
+
+export default function AppLoading() {
+  return (
+    <div className="flex-1 flex items-center justify-center min-h-[50vh]">
+      <div className="flex flex-col items-center gap-3">
+        <Loader2 className="w-8 h-8 text-primary animate-spin" />
+        <p className="text-sm text-muted-foreground font-mono">Loading...</p>
+      </div>
+    </div>
+  )
+}

app/(app)/ops/page.tsx

@@ -1,5 +1,6 @@
 import { createClient } from '@/lib/supabase/server'
 import { OpsClient } from './ops-client'
+import type { Tables } from '@/types/database'
 
 export default async function OpsPage() {
   const supabase = await createClient()
@@ -16,17 +17,17 @@ export default async function OpsPage() {
     supabase.from('knowledge_base').select('*').eq('space_id', member.space_id).order('is_pinned', { ascending: false }).order('created_at', { ascending: false }),
     supabase.from('area_leads').select('*').eq('space_id', member.space_id).order('area_name'),
     canSeeSecrets
-      ? supabase.from('secrets').select('id, title, area, created_at').eq('space_id', member.space_id)
-      : Promise.resolve({ data: [] }),
+      ? supabase.from('secrets').select('id, title, area, created_at, label, value, description, icon, space_id, created_by, updated_at, category, notes').eq('space_id', member.space_id)
+      : Promise.resolve({ data: [] as Tables<'secrets'>[] }),
   ])
 
   return (
     <OpsClient
-      member={member}
+      member={member as Tables<'space_members'>}
       spaceId={member.space_id}
       kbEntries={kbEntries ?? []}
       areaLeads={areaLeads ?? []}
-      secrets={(secretsResult as any)?.data ?? []}
+      secrets={secretsResult.data ?? []}
       canSeeSecrets={canSeeSecrets}
     />
   )

app/error.tsx

@@ -0,0 +1,60 @@
+'use client'
+
+import { useEffect } from 'react'
+import { AlertTriangle, RefreshCw, Home } from 'lucide-react'
+import Link from 'next/link'
+
+export default function Error({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string }
+  reset: () => void
+}) {
+  useEffect(() => {
+    // Log the error to an error reporting service
+    console.error('[App Error]', error)
+  }, [error])
+
+  return (
+    <div className="min-h-screen bg-background flex items-center justify-center p-4">
+      <div className="max-w-md w-full text-center">
+        <div className="w-16 h-16 rounded-full bg-destructive/10 flex items-center justify-center mx-auto mb-6">
+          <AlertTriangle className="w-8 h-8 text-destructive" />
+        </div>
+        
+        <h1 className="text-2xl font-bold text-foreground mb-2">
+          Something went wrong
+        </h1>
+        
+        <p className="text-muted-foreground mb-6">
+          An unexpected error occurred. Please try again or contact support if the problem persists.
+        </p>
+
+        {error.digest && (
+          <p className="text-xs text-muted-foreground/60 font-mono mb-6">
+            Error ID: {error.digest}
+          </p>
+        )}
+
+        <div className="flex flex-col sm:flex-row gap-3 justify-center">
+          <button
+            onClick={reset}
+            className="inline-flex items-center justify-center gap-2 px-4 py-2.5 rounded-md bg-primary text-primary-foreground font-medium text-sm hover:bg-primary/90 transition-colors"
+          >
+            <RefreshCw className="w-4 h-4" />
+            Try again
+          </button>
+          
+          <Link
+            href="/dashboard"
+            className="inline-flex items-center justify-center gap-2 px-4 py-2.5 rounded-md border border-border text-foreground font-medium text-sm hover:bg-accent transition-colors"
+          >
+            <Home className="w-4 h-4" />
+            Go to Dashboard
+          </Link>
+        </div>
+      </div>
+    </div>
+  )
+}

app/global-error.tsx

@@ -0,0 +1,62 @@
+'use client'
+
+import { useEffect } from 'react'
+
+export default function GlobalError({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string }
+  reset: () => void
+}) {
+  useEffect(() => {
+    console.error('[Global Error]', error)
+  }, [error])
+
+  return (
+    <html lang="en">
+      <body className="font-sans antialiased">
+        <div className="min-h-screen bg-[#111] flex items-center justify-center p-4">
+          <div className="max-w-md w-full text-center">
+            <div className="w-16 h-16 rounded-full bg-red-500/20 flex items-center justify-center mx-auto mb-6">
+              <svg
+                className="w-8 h-8 text-red-500"
+                fill="none"
+                stroke="currentColor"
+                viewBox="0 0 24 24"
+              >
+                <path
+                  strokeLinecap="round"
+                  strokeLinejoin="round"
+                  strokeWidth={2}
+                  d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
+                />
+              </svg>
+            </div>
+
+            <h1 className="text-2xl font-bold text-white mb-2 font-mono">
+              Critical Error
+            </h1>
+
+            <p className="text-zinc-400 mb-6">
+              A critical error occurred. Please refresh the page or try again later.
+            </p>
+
+            {error.digest && (
+              <p className="text-xs text-zinc-600 font-mono mb-6">
+                Error ID: {error.digest}
+              </p>
+            )}
+
+            <button
+              onClick={reset}
+              className="inline-flex items-center justify-center gap-2 px-6 py-3 rounded-md bg-white text-black font-medium text-sm hover:bg-zinc-200 transition-colors"
+            >
+              Try again
+            </button>
+          </div>
+        </div>
+      </body>
+    </html>
+  )
+}

app/loading.tsx

@@ -0,0 +1,18 @@
+export default function Loading() {
+  return (
+    <div className="min-h-screen bg-background flex items-center justify-center">
+      <div className="flex flex-col items-center gap-4">
+        <div className="w-10 h-10 rounded bg-primary flex items-center justify-center animate-pulse">
+          <span className="text-primary-foreground font-mono text-sm font-bold">
+            {'{'}<span>hs</span>{'}'}
+          </span>
+        </div>
+        <div className="flex gap-1">
+          <div className="w-2 h-2 rounded-full bg-primary animate-bounce [animation-delay:-0.3s]" />
+          <div className="w-2 h-2 rounded-full bg-primary animate-bounce [animation-delay:-0.15s]" />
+          <div className="w-2 h-2 rounded-full bg-primary animate-bounce" />
+        </div>
+      </div>
+    </div>
+  )
+}

app/login/page.tsx

@@ -11,6 +11,7 @@ export default function LoginPage() {
   const [password, setPassword] = useState('')
   const [error, setError] = useState('')
   const [loading, setLoading] = useState(false)
+  const [oauthLoading, setOauthLoading] = useState<'github' | 'google' | null>(null)
 
   async function handleSubmit(e: React.FormEvent) {
     e.preventDefault()
@@ -27,6 +28,22 @@ export default function LoginPage() {
     }
   }
 
+  async function handleOAuthLogin(provider: 'github' | 'google') {
+    setOauthLoading(provider)
+    setError('')
+    const supabase = createClient()
+    const { error } = await supabase.auth.signInWithOAuth({
+      provider,
+      options: {
+        redirectTo: `${window.location.origin}/auth/callback`,
+      },
+    })
+    if (error) {
+      setError(error.message)
+      setOauthLoading(null)
+    }
+  }
+
   return (
     <div className="min-h-screen bg-[#111] flex items-center justify-center relative overflow-hidden">
       {/* Grid background */}
@@ -102,20 +119,30 @@ export default function LoginPage() {
           </div>
 
           <div className="flex gap-3">
-            <button className="flex-1 flex items-center justify-center gap-2 bg-[#232323] border border-[#333] text-white font-mono text-xs py-2.5 rounded hover:border-[#555] transition">
+            <button
+              type="button"
+              onClick={() => handleOAuthLogin('github')}
+              disabled={oauthLoading !== null}
+              className="flex-1 flex items-center justify-center gap-2 bg-[#232323] border border-[#333] text-white font-mono text-xs py-2.5 rounded hover:border-[#555] transition disabled:opacity-60"
+            >
               <svg className="w-4 h-4" viewBox="0 0 24 24" fill="currentColor">
                 <path d="M12 0C5.37 0 0 5.37 0 12c0 5.31 3.435 9.795 8.205 11.385.6.105.825-.255.825-.57 0-.285-.015-1.23-.015-2.235-3.015.555-3.795-.735-4.035-1.41-.135-.345-.72-1.41-1.23-1.695-.42-.225-1.02-.78-.015-.795.945-.015 1.62.87 1.845 1.23 1.08 1.815 2.805 1.305 3.495.99.105-.78.42-1.305.765-1.605-2.67-.3-5.46-1.335-5.46-5.925 0-1.305.465-2.385 1.23-3.225-.12-.3-.54-1.53.12-3.18 0 0 1.005-.315 3.3 1.23.96-.27 1.98-.405 3-.405s2.04.135 3 .405c2.295-1.56 3.3-1.23 3.3-1.23.66 1.65.24 2.88.12 3.18.765.84 1.23 1.905 1.23 3.225 0 4.605-2.805 5.625-5.475 5.925.435.375.81 1.095.81 2.22 0 1.605-.015 2.895-.015 3.3 0 .315.225.69.825.57A12.02 12.02 0 0024 12c0-6.63-5.37-12-12-12z" />
               </svg>
-              GitHub
+              {oauthLoading === 'github' ? 'Redirecting...' : 'GitHub'}
             </button>
-            <button className="flex-1 flex items-center justify-center gap-2 bg-[#232323] border border-[#333] text-white font-mono text-xs py-2.5 rounded hover:border-[#555] transition">
+            <button
+              type="button"
+              onClick={() => handleOAuthLogin('google')}
+              disabled={oauthLoading !== null}
+              className="flex-1 flex items-center justify-center gap-2 bg-[#232323] border border-[#333] text-white font-mono text-xs py-2.5 rounded hover:border-[#555] transition disabled:opacity-60"
+            >
               <svg className="w-4 h-4" viewBox="0 0 24 24">
                 <path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"/>
                 <path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/>
                 <path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"/>
                 <path fill="#EA4335" d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"/>
               </svg>
-              Google
+              {oauthLoading === 'google' ? 'Redirecting...' : 'Google'}
             </button>
           </div>
 

app/not-found.tsx

@@ -0,0 +1,42 @@
+import Link from 'next/link'
+import { FileQuestion, Home, ArrowLeft } from 'lucide-react'
+
+export default function NotFound() {
+  return (
+    <div className="min-h-screen bg-background flex items-center justify-center p-4">
+      <div className="max-w-md w-full text-center">
+        <div className="w-16 h-16 rounded-full bg-muted flex items-center justify-center mx-auto mb-6">
+          <FileQuestion className="w-8 h-8 text-muted-foreground" />
+        </div>
+        
+        <h1 className="text-6xl font-bold text-foreground mb-2 font-mono">404</h1>
+        
+        <h2 className="text-xl font-semibold text-foreground mb-2">
+          Page not found
+        </h2>
+        
+        <p className="text-muted-foreground mb-8">
+          The page you're looking for doesn't exist or has been moved.
+        </p>
+
+        <div className="flex flex-col sm:flex-row gap-3 justify-center">
+          <Link
+            href="/dashboard"
+            className="inline-flex items-center justify-center gap-2 px-4 py-2.5 rounded-md bg-primary text-primary-foreground font-medium text-sm hover:bg-primary/90 transition-colors"
+          >
+            <Home className="w-4 h-4" />
+            Go to Dashboard
+          </Link>
+          
+          <Link
+            href="/"
+            className="inline-flex items-center justify-center gap-2 px-4 py-2.5 rounded-md border border-border text-foreground font-medium text-sm hover:bg-accent transition-colors"
+          >
+            <ArrowLeft className="w-4 h-4" />
+            Back to Home
+          </Link>
+        </div>
+      </div>
+    </div>
+  )
+}

components/app-sidebar.tsx

@@ -5,7 +5,10 @@ import { usePathname } from 'next/navigation'
 import { useState } from 'react'
 import { cn } from '@/lib/utils'
 import { signOut } from '@/lib/auth-actions'
-import type { SpaceMember, Space } from '@/lib/types'
+import type { Tables } from '@/types/database'
+
+type SpaceMember = Tables<'space_members'>
+type Space = Tables<'spaces'>
 import {
   Menu, X, LayoutDashboard, ListChecks, FolderKanban, Settings2,
   MessageSquare, Users, CreditCard, BookUser, Download, LogOut,
@@ -46,7 +49,7 @@ function NavLink({ href, label, icon: Icon, badge, active, onClick }: NavLinkPro
 }
 
 interface AppSidebarProps {
-  member: SpaceMember & { spaces: Space }
+  member: SpaceMember & { spaces: Space | null }
   taskBadge?: number
   commsBadge?: number
   paymentBadge?: number

lib/actions.ts

@@ -5,6 +5,25 @@ import { redirect } from 'next/navigation'
 import { revalidatePath } from 'next/cache'
 import type { SupabaseClient } from '@supabase/supabase-js'
 import type { Database } from '@/types/database'
+import {
+  createTaskSchema,
+  taskIdSchema,
+  createProjectSchema,
+  updateProjectStatusSchema,
+  addMemberSchema,
+  updateMemberSchema,
+  createContactSchema,
+  updateContactSchema,
+  createKbEntrySchema,
+  updateKbEntrySchema,
+  createSecretSchema,
+  logCashPaymentSchema,
+  linkPaymentSchema,
+  updateSpaceSettingsSchema,
+  saveIntegrationSchema,
+  upsertAreaLeadSchema,
+  uuidSchema,
+} from '@/lib/validations'
 
 // ─── Auth ────────────────────────────────────────────────────────────────────
 
@@ -61,6 +80,13 @@ export async function createTask(formData: {
   recurrence?: string
   due_date?: string
 }) {
+  // Validate input
+  const parsed = createTaskSchema.safeParse(formData)
+  if (!parsed.success) {
+    return { error: parsed.error.errors[0]?.message || 'Invalid input' }
+  }
+  const input = parsed.data
+
   const supabase = await createClient()
   const { data: { user } } = await supabase.auth.getUser()
   if (!user) return { error: 'Not authenticated' }
@@ -70,12 +96,12 @@ export async function createTask(formData: {
 
   const { data, error } = await supabase.from('tasks').insert({
     space_id: member.space_id,
-    title: formData.title,
-    description: formData.description,
-    task_type: formData.type || 'task',
-    area: formData.area,
-    recurrence: formData.recurrence || 'none',
-    due_date: formData.due_date || null,
+    title: input.title,
+    description: input.description,
+    task_type: input.type || 'task',
+    area: input.area,
+    recurrence: input.recurrence || 'none',
+    due_date: input.due_date || null,
     status: 'open',
     requested_by: user.id,
     requested_by_name: member.display_name,
@@ -100,6 +126,9 @@ export async function createTask(formData: {
 }
 
 export async function claimTask(taskId: string) {
+  const idResult = taskIdSchema.safeParse(taskId)
+  if (!idResult.success) return { error: 'Invalid task ID' }
+
   const supabase = await createClient()
   const { data: { user } } = await supabase.auth.getUser()
   if (!user) return { error: 'Not authenticated' }
@@ -111,7 +140,7 @@ export async function claimTask(taskId: string) {
     claimed_by: user.id,
     claimed_by_name: member.display_name,
     status: 'claimed',
-  }).eq('id', taskId).eq('space_id', member.space_id)
+  }).eq('id', idResult.data).eq('space_id', member.space_id)
 
   if (error) return { error: error.message }
 

lib/auth-actions.ts

@@ -3,6 +3,7 @@
 import { createClient } from '@/lib/supabase/server'
 import { createAdminClient } from '@/lib/supabase/admin'
 import { redirect } from 'next/navigation'
+import { checkRateLimit, sanitizeString, sanitizeSlug } from '@/lib/security'
 
 function generateInviteCode() {
   const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
@@ -24,6 +25,22 @@ export async function createSpace(formData: {
   const { data: { user }, error: userErr } = await supabase.auth.getUser()
   if (userErr || !user) return { error: 'Not authenticated' }
 
+  // Rate limit space creation
+  const rateLimit = checkRateLimit(`createspace:${user.id}`, 3, 3600000) // 3 per hour
+  if (!rateLimit.allowed) {
+    return { error: 'Too many space creation attempts. Please try again later.' }
+  }
+
+  // Sanitize inputs
+  const spaceName = sanitizeString(formData.spaceName).slice(0, 100)
+  const spaceSlug = sanitizeSlug(formData.spaceSlug)
+  const spaceCity = formData.spaceCity ? sanitizeString(formData.spaceCity).slice(0, 100) : null
+  const displayName = sanitizeString(formData.displayName).slice(0, 100)
+
+  if (!spaceName || !spaceSlug || !displayName) {
+    return { error: 'Invalid input. Please check your entries.' }
+  }
+
   // Use admin client for inserts (bypasses RLS)
   const admin = createAdminClient()
 
@@ -31,7 +48,7 @@ export async function createSpace(formData: {
   const { data: existingSpace } = await admin
     .from('spaces')
     .select('id')
-    .eq('slug', formData.spaceSlug.toLowerCase().trim())
+    .eq('slug', spaceSlug)
     .maybeSingle()
 
   if (existingSpace) {
@@ -42,9 +59,9 @@ export async function createSpace(formData: {
   const { data: space, error: spaceErr } = await admin
     .from('spaces')
     .insert({
-      name: formData.spaceName,
-      slug: formData.spaceSlug.toLowerCase().trim(),
-      city: formData.spaceCity || null,
+      name: spaceName,
+      slug: spaceSlug,
+      city: spaceCity,
       invite_code: generateInviteCode(),
     })
     .select('id')
@@ -63,7 +80,7 @@ export async function createSpace(formData: {
     .insert({
       space_id: space.id,
       user_id: user.id,
-      display_name: formData.displayName || user.email,
+      display_name: displayName || user.email,
       email: user.email,
       role: 'admin',
       tier: 'plus',
@@ -117,6 +134,12 @@ export async function joinSpace(formData: {
 }
 
 export async function signIn(email: string, password: string) {
+  // Rate limit by email to prevent brute force
+  const rateLimit = checkRateLimit(`signin:${email.toLowerCase()}`, 5, 60000)
+  if (!rateLimit.allowed) {
+    return { error: 'Too many login attempts. Please try again later.' }
+  }
+
   const supabase = await createClient()
   
   const { data, error } = await supabase.auth.signInWithPassword({

lib/security.ts

@@ -0,0 +1,172 @@
+/**
+ * Security utilities for input sanitization and validation
+ */
+
+/**
+ * Sanitize a string by removing potentially dangerous characters
+ * Prevents XSS and injection attacks when displaying user input
+ */
+export function sanitizeString(input: string): string {
+  if (typeof input !== 'string') return ''
+  return input
+    .replace(/[<>]/g, '') // Remove HTML brackets
+    .replace(/javascript:/gi, '') // Remove javascript: protocol
+    .replace(/on\w+=/gi, '') // Remove event handlers
+    .trim()
+}
+
+/**
+ * Sanitize HTML content - strips all HTML tags
+ * Use when you need plain text from user input
+ */
+export function stripHtml(input: string): string {
+  if (typeof input !== 'string') return ''
+  return input.replace(/<[^>]*>/g, '').trim()
+}
+
+/**
+ * Escape HTML entities for safe display
+ * Use when you need to display user input in HTML context
+ */
+export function escapeHtml(input: string): string {
+  if (typeof input !== 'string') return ''
+  const htmlEntities: Record<string, string> = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#x27;',
+    '/': '&#x2F;',
+  }
+  return input.replace(/[&<>"'/]/g, char => htmlEntities[char] || char)
+}
+
+/**
+ * Validate and sanitize email address
+ */
+export function sanitizeEmail(email: string): string | null {
+  if (typeof email !== 'string') return null
+  const sanitized = email.toLowerCase().trim()
+  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+  return emailRegex.test(sanitized) ? sanitized : null
+}
+
+/**
+ * Sanitize URL - only allow http/https protocols
+ */
+export function sanitizeUrl(url: string): string | null {
+  if (typeof url !== 'string') return null
+  try {
+    const parsed = new URL(url.trim())
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+      return null
+    }
+    return parsed.href
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Sanitize slug - only allow lowercase alphanumeric and hyphens
+ */
+export function sanitizeSlug(input: string): string {
+  if (typeof input !== 'string') return ''
+  return input
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, '')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '')
+    .slice(0, 50)
+}
+
+/**
+ * Check if input contains potential SQL injection patterns
+ * Note: Always use parameterized queries - this is an additional safety layer
+ */
+export function hasSqlInjectionPatterns(input: string): boolean {
+  if (typeof input !== 'string') return false
+  const patterns = [
+    /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER|CREATE|TRUNCATE)\b)/i,
+    /(--|;|\/\*|\*\/)/,
+    /(\b(OR|AND)\b\s+\d+\s*=\s*\d+)/i,
+  ]
+  return patterns.some(pattern => pattern.test(input))
+}
+
+/**
+ * Validate UUID format
+ */
+export function isValidUuid(id: string): boolean {
+  if (typeof id !== 'string') return false
+  const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+  return uuidRegex.test(id)
+}
+
+/**
+ * Truncate string to max length with ellipsis
+ */
+export function truncate(input: string, maxLength: number): string {
+  if (typeof input !== 'string') return ''
+  if (input.length <= maxLength) return input
+  return input.slice(0, maxLength - 3) + '...'
+}
+
+/**
+ * Simple in-memory rate limiter for server actions
+ * For production, use Redis-based rate limiting
+ */
+const rateLimitStore = new Map<string, { count: number; resetTime: number }>()
+
+export function checkRateLimit(
+  identifier: string,
+  maxRequests: number = 10,
+  windowMs: number = 60000
+): { allowed: boolean; remaining: number; resetIn: number } {
+  const now = Date.now()
+  const entry = rateLimitStore.get(identifier)
+
+  if (!entry || now > entry.resetTime) {
+    rateLimitStore.set(identifier, { count: 1, resetTime: now + windowMs })
+    return { allowed: true, remaining: maxRequests - 1, resetIn: windowMs }
+  }
+
+  if (entry.count >= maxRequests) {
+    return { allowed: false, remaining: 0, resetIn: entry.resetTime - now }
+  }
+
+  entry.count++
+  return { allowed: true, remaining: maxRequests - entry.count, resetIn: entry.resetTime - now }
+}
+
+/**
+ * Clear expired rate limit entries (call periodically)
+ */
+export function cleanupRateLimits(): void {
+  const now = Date.now()
+  for (const [key, entry] of rateLimitStore.entries()) {
+    if (now > entry.resetTime) {
+      rateLimitStore.delete(key)
+    }
+  }
+}
+
+/**
+ * Validate content length
+ */
+export function validateContentLength(
+  content: string,
+  minLength: number = 0,
+  maxLength: number = 10000
+): { valid: boolean; error?: string } {
+  if (typeof content !== 'string') {
+    return { valid: false, error: 'Content must be a string' }
+  }
+  if (content.length < minLength) {
+    return { valid: false, error: `Content must be at least ${minLength} characters` }
+  }
+  if (content.length > maxLength) {
+    return { valid: false, error: `Content must be less than ${maxLength} characters` }
+  }
+  return { valid: true }
+}

lib/validations.ts

@@ -0,0 +1,171 @@
+import { z } from 'zod'
+
+// ─── Auth ────────────────────────────────────────────────────────────────────
+
+export const signInSchema = z.object({
+  email: z.string().email('Invalid email address'),
+  password: z.string().min(1, 'Password is required'),
+})
+
+export const signUpSchema = z.object({
+  email: z.string().email('Invalid email address'),
+  password: z.string().min(8, 'Password must be at least 8 characters'),
+  fullName: z.string().min(1, 'Full name is required').max(100, 'Name is too long'),
+  action: z.enum(['create', 'join']),
+  spaceName: z.string().max(100).optional(),
+  spaceSlug: z.string().regex(/^[a-z0-9]+$/, 'Slug must be lowercase letters and numbers only').max(50).optional(),
+  city: z.string().max(100).optional(),
+  inviteCode: z.string().max(20).optional(),
+})
+
+export const createSpaceSchema = z.object({
+  spaceName: z.string().min(1, 'Space name is required').max(100, 'Name is too long'),
+  spaceSlug: z.string().min(1, 'Slug is required').max(50).regex(/^[a-z0-9]+$/, 'Slug must be lowercase letters and numbers only'),
+  spaceCity: z.string().max(100).optional(),
+  displayName: z.string().min(1, 'Display name is required').max(100),
+})
+
+export const joinSpaceSchema = z.object({
+  inviteCode: z.string().min(1, 'Invite code is required').max(20),
+  displayName: z.string().min(1, 'Display name is required').max(100),
+})
+
+// ─── Tasks ───────────────────────────────────────────────────────────────────
+
+export const createTaskSchema = z.object({
+  title: z.string().min(1, 'Title is required').max(200, 'Title is too long'),
+  description: z.string().max(2000, 'Description is too long').optional(),
+  type: z.string().max(50).default('task'),
+  area: z.string().max(100).optional(),
+  recurrence: z.enum(['none', 'daily', 'weekly', 'monthly']).default('none'),
+  due_date: z.string().datetime().optional().nullable(),
+})
+
+export const taskIdSchema = z.string().uuid('Invalid task ID')
+
+// ─── Projects ────────────────────────────────────────────────────────────────
+
+export const createProjectSchema = z.object({
+  title: z.string().min(1, 'Title is required').max(200),
+  description: z.string().max(2000).optional(),
+  area: z.string().max(100).optional(),
+  due_date: z.string().datetime().optional().nullable(),
+})
+
+export const updateProjectStatusSchema = z.object({
+  projectId: z.string().uuid('Invalid project ID'),
+  status: z.enum(['planning', 'active', 'paused', 'completed', 'cancelled']),
+})
+
+// ─── Members ─────────────────────────────────────────────────────────────────
+
+export const addMemberSchema = z.object({
+  email: z.string().email('Invalid email address'),
+  display_name: z.string().min(1, 'Display name is required').max(100),
+  role: z.enum(['admin', 'board', 'treasurer', 'member']).default('member'),
+  tier: z.enum(['plus', 'basic', 'associate']).default('basic'),
+})
+
+export const updateMemberSchema = z.object({
+  memberId: z.string().uuid('Invalid member ID'),
+  display_name: z.string().min(1).max(100).optional(),
+  email: z.string().email().optional(),
+  phone: z.string().max(20).optional().nullable(),
+  handle: z.string().max(50).optional().nullable(),
+  role: z.enum(['admin', 'board', 'treasurer', 'member']).optional(),
+  tier: z.enum(['plus', 'basic', 'associate']).optional(),
+  status: z.enum(['current', 'unverified', 'late', 'inactive']).optional(),
+  has_card_access: z.boolean().optional(),
+})
+
+// ─── Contacts ────────────────────────────────────────────────────────────────
+
+export const createContactSchema = z.object({
+  name: z.string().min(1, 'Name is required').max(200),
+  contact_type: z.enum(['vendor', 'sponsor', 'partner', 'city', 'media', 'other']),
+  email: z.string().email().optional().nullable(),
+  phone: z.string().max(20).optional().nullable(),
+  details: z.string().max(500).optional().nullable(),
+  note: z.string().max(2000).optional().nullable(),
+  group_label: z.string().max(100).optional().nullable(),
+  tags: z.array(z.string().max(50)).max(10).optional(),
+  code: z.string().max(50).optional().nullable(),
+})
+
+export const updateContactSchema = createContactSchema.partial().extend({
+  contactId: z.string().uuid('Invalid contact ID'),
+})
+
+// ─── Knowledge Base ──────────────────────────────────────────────────────────
+
+export const createKbEntrySchema = z.object({
+  title: z.string().min(1, 'Title is required').max(200),
+  content: z.string().min(1, 'Content is required').max(50000),
+  area: z.string().max(100).optional().nullable(),
+  visibility: z.enum(['public', 'members', 'board', 'admin']).default('members'),
+  is_pinned: z.boolean().default(false),
+  tags: z.array(z.string().max(50)).max(20).optional(),
+  icon: z.string().max(10).optional().nullable(),
+})
+
+export const updateKbEntrySchema = createKbEntrySchema.partial().extend({
+  entryId: z.string().uuid('Invalid entry ID'),
+})
+
+// ─── Secrets ─────────────────────────────────────────────────────────────────
+
+export const createSecretSchema = z.object({
+  title: z.string().min(1, 'Title is required').max(200),
+  value: z.string().min(1, 'Value is required').max(5000),
+  description: z.string().max(500).optional().nullable(),
+  area: z.string().max(100).optional().nullable(),
+  icon: z.string().max(10).optional().nullable(),
+})
+
+// ─── Payments ────────────────────────────────────────────────────────────────
+
+export const logCashPaymentSchema = z.object({
+  amount: z.number().positive('Amount must be positive'),
+  from_identifier: z.string().min(1, 'Payer name is required').max(200),
+  from_note: z.string().max(500).optional().nullable(),
+  transaction_date: z.string().datetime().optional(),
+})
+
+export const linkPaymentSchema = z.object({
+  paymentId: z.string().uuid('Invalid payment ID'),
+  memberId: z.string().uuid('Invalid member ID'),
+})
+
+// ─── Settings ────────────────────────────────────────────────────────────────
+
+export const updateSpaceSettingsSchema = z.object({
+  name: z.string().min(1).max(100).optional(),
+  city: z.string().max(100).optional().nullable(),
+  require_approval: z.boolean().optional(),
+  public_member_directory: z.boolean().optional(),
+})
+
+export const saveIntegrationSchema = z.object({
+  platform: z.string().min(1).max(50),
+  config: z.record(z.string().max(500)),
+})
+
+// ─── Area Leads ──────────────────────────────────────────────────────────────
+
+export const upsertAreaLeadSchema = z.object({
+  id: z.string().uuid().optional(),
+  area_name: z.string().min(1, 'Area name is required').max(100),
+  lead_handle: z.string().min(1, 'Lead handle is required').max(100),
+  description: z.string().max(500).optional().nullable(),
+})
+
+// ─── Generic ID schemas ──────────────────────────────────────────────────────
+
+export const uuidSchema = z.string().uuid('Invalid ID format')
+
+// Helper type exports
+export type CreateTaskInput = z.infer<typeof createTaskSchema>
+export type CreateProjectInput = z.infer<typeof createProjectSchema>
+export type CreateContactInput = z.infer<typeof createContactSchema>
+export type CreateKbEntryInput = z.infer<typeof createKbEntrySchema>
+export type CreateSecretInput = z.infer<typeof createSecretSchema>