Harden auth, payments, and frontend against review findings.

Close exploitable gaps in booking/payment flows, enforce token versioning and account checks, gate sensitive payment data, and add middleware plus input validation across admin routes.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/app/(public)/book/[eventId]/page.tsx

@@ -7,6 +7,7 @@ import { useLanguage } from '@/context/LanguageContext';
 import { useAuth } from '@/context/AuthContext';
 import { eventsApi, ticketsApi, paymentOptionsApi, Event, PaymentOptionsConfig } from '@/lib/api';
 import { formatPrice, formatDateLong, formatTime, getTpagoLink } from '@/lib/utils';
+import { isSafeExternalUrl } from '@/lib/safeRedirect';
 import Card from '@/components/ui/Card';
 import Button from '@/components/ui/Button';
 import Input from '@/components/ui/Input';
@@ -155,8 +156,12 @@ export default function BookingPage() {
             return;
           }
 
-          // Redirect to external booking if enabled
-          if (eventRes.event.externalBookingEnabled && eventRes.event.externalBookingUrl) {
+          // Redirect to external booking if enabled (only https:// targets are allowed)
+          if (
+            eventRes.event.externalBookingEnabled &&
+            eventRes.event.externalBookingUrl &&
+            isSafeExternalUrl(eventRes.event.externalBookingUrl)
+          ) {
             window.location.href = eventRes.event.externalBookingUrl;
             return;
           }
@@ -473,6 +478,16 @@ export default function BookingPage() {
           paymentMethod: formData.paymentMethod,
           ticketCount,
         });
+        // Fetch full payment credentials now that we hold a ticket capability token
+        try {
+          const { paymentOptions } = await paymentOptionsApi.getForEvent(
+            params.eventId as string,
+            primaryTicket.id
+          );
+          setPaymentConfig(paymentOptions);
+        } catch {
+          // Keep the flags-only config from initial load if the gated fetch fails
+        }
         setStep('manual_payment');
       } else {
         // Cash payment - go straight to success