Harden auth, payments, and frontend against review findings.

Close exploitable gaps in booking/payment flows, enforce token versioning and account checks, gate sensitive payment data, and add middleware plus input validation across admin routes.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/lib/rateLimit.ts

@@ -0,0 +1,75 @@
+import { Context } from 'hono';
+
+/**
+ * Simple in-memory rate limiter.
+ *
+ * Suitable for a single backend instance (the current deployment model). If the
+ * backend is ever scaled horizontally, replace the in-memory Map with a shared
+ * store (e.g. Redis) so limits are enforced across instances.
+ */
+
+interface Bucket {
+  count: number;
+  resetAt: number;
+}
+
+const buckets = new Map<string, Bucket>();
+
+// Periodically drop expired buckets so the Map does not grow unbounded.
+const cleanup = setInterval(() => {
+  const now = Date.now();
+  for (const [key, bucket] of buckets) {
+    if (now > bucket.resetAt) buckets.delete(key);
+  }
+}, 60_000);
+// Don't keep the process alive just for cleanup.
+(cleanup as any).unref?.();
+
+/** Best-effort client IP extraction (honours common reverse-proxy headers). */
+export function getClientIp(c: Context): string {
+  const forwarded = c.req.header('x-forwarded-for');
+  if (forwarded) return forwarded.split(',')[0].trim();
+  return c.req.header('x-real-ip') || 'unknown';
+}
+
+/**
+ * Consume one unit against a key. Returns whether the request is allowed and,
+ * when blocked, how many seconds until the window resets.
+ */
+export function consumeRateLimit(
+  key: string,
+  max: number,
+  windowMs: number
+): { allowed: boolean; retryAfter?: number } {
+  const now = Date.now();
+  const bucket = buckets.get(key);
+
+  if (!bucket || now > bucket.resetAt) {
+    buckets.set(key, { count: 1, resetAt: now + windowMs });
+    return { allowed: true };
+  }
+
+  bucket.count++;
+  if (bucket.count > max) {
+    return { allowed: false, retryAfter: Math.ceil((bucket.resetAt - now) / 1000) };
+  }
+  return { allowed: true };
+}
+
+/**
+ * Hono middleware factory that rate-limits by client IP.
+ * Use a distinct `prefix` per endpoint group so unrelated routes don't share a bucket.
+ */
+export function rateLimitMiddleware(opts: { max: number; windowMs: number; prefix: string }) {
+  return async (c: Context, next: () => Promise<void>) => {
+    const ip = getClientIp(c);
+    const result = consumeRateLimit(`${opts.prefix}:${ip}`, opts.max, opts.windowMs);
+    if (!result.allowed) {
+      return c.json(
+        { error: 'Too many requests. Please try again later.', retryAfter: result.retryAfter },
+        429
+      );
+    }
+    await next();
+  };
+}