[Fix] Issue-1101 Security hardening: authz on reward transactions, input validation, regex escaping, secret scrubbing

[devin-ai-integration]

Description

Fixes #1101

Security audit fixes for the issue classes requested (secrets, injection, input validation, CORS, debug endpoints, authz, dependencies).

Missing authentication / IDOR (critical) — GET /api/rewards/transactions/image/:imageId and GET /api/rewards/transactions/:transactionId were unauthenticated, so anyone could enumerate reward ledger entries by ObjectId. Both now require a session, and the single-transaction read additionally requires participation:

const isParticipant = [transaction.user_id, transaction.creator_id].some(
  (id) => id && id.toString() === userId
);
if (role !== UserType.ADMIN && !isParticipant) return 403;

Committed credentials (critical) — packages/app/.env.example / .env.docker shipped a real-looking AWS access key + secret, an email-service auth token and a CloudFront key-pair ID; docker-compose.yml hardcoded admin:password123. All replaced with placeholders; compose mongo creds are now ${MONGO_ROOT_USERNAME:-openlogo} / ${MONGO_ROOT_PASSWORD:-local_dev_only_password} (local-throwaway defaults, overridable). The previously committed AWS key, CloudFront key-pair ID and email token should be treated as leaked and rotated — they remain in git history.

Unvalidated user input — extension flowed from request bodies into S3 object keys ({bucketKey}/{extension}/{name}.{extension}) and DB records with no allowlist. Added imageExtensionSchema (png|jpg|jpeg|webp|svg, lowercased) and applied it in getPreSignedController, addCatalogController, updateCatalogController and newLogoRequestController.

Regex injection / ReDoS — user input reached mongo $regex unescaped (notably getAllImages(search) from the catalog search query). Added utils/escapeRegExp.js and applied it in repositories/images.js and controllers/logo.js (users.js already escaped).

Cookie hardening — cookie options were duplicated in 8 places and never set secure. Centralised as getAuthCookieOptions() in utils/constants.js (httpOnly, sameSite: strict, secure in prod) and used from the auth controller and auth middleware.

Dependencies — react-router 7.15.1 → ^7.18.2 (unauthenticated DoS, open redirect, RSC CSRF bypass), happy-dom ^16 → ^20.8.9 (VM-context escape RCE, dev-only), uuid ^9 → ^11.1.1. Not fixed here: vitest/vite/esbuild advisories need a vite 5 → 7 major bump, image-size has no patched release, multer 1.x is EOL — all dev/limited-exposure, worth a follow-up.

Not vulnerable / no change needed: no SQL (mongoose only); CORS is restricted to CLIENT_URL rather than *; no debug endpoints, though /docs (Swagger UI) is publicly reachable in every environment and may deserve prod gating.

Also jest.setup.js disables mongoose command buffering in tests, so fire-and-forget session writes fail fast instead of logging after the run ends — that was making pnpm --filter app test exit 1 with all 640 tests passing.

What type of PR is this? (Check all applicable)

• 🍕 Feature
• 🐛 Bug Fix
• 📄 Documentation Update
• 👨‍💻 Code Refactor
• 🔥 Performance Improvements
• ✅ Test
• 🛠️ CI/CD

Screenshots (if applicable)

n/a — backend only.

Checklist

• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Tests: added 401/403 cases for the two reward endpoints; pnpm lint, pnpm check, pnpm --filter app test (640), pnpm --filter ui test (566) and pnpm build all pass.

Link to Devin session: https://app.devin.ai/sessions/06593a697bcf4e49bc10ede78584b697
Requested by: @sunnykgupta

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openlogo-prod-web	Ready	Preview	Aug 26, 2026 6:29am
openlogo-staging-web	Ready	Preview	Aug 26, 2026 6:29am

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud