Harden auth, payments, and frontend against review findings.

Close exploitable gaps in booking/payment flows, enforce token versioning and account checks, gate sensitive payment data, and add middleware plus input validation across admin routes.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/app/api/revalidate/route.ts

@@ -1,14 +1,27 @@
 import { revalidateTag } from 'next/cache';
 import { NextRequest, NextResponse } from 'next/server';
+import { timingSafeEqual } from 'crypto';
+
+// Constant-time string comparison to avoid leaking the secret via response timing.
+function secretsMatch(provided: unknown, expected: string): boolean {
+  if (typeof provided !== 'string' || provided.length === 0) return false;
+  const a = Buffer.from(provided);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
 
 export async function POST(request: NextRequest) {
   try {
     const body = await request.json();
     const { secret, tag } = body;
 
-    // Validate the revalidation secret
+    // Validate the revalidation secret. Reject if it is unset or left at an insecure default.
     const revalidateSecret = process.env.REVALIDATE_SECRET;
-    if (!revalidateSecret || secret !== revalidateSecret) {
+    if (!revalidateSecret || revalidateSecret === 'change-me' || revalidateSecret.length < 16) {
+      return NextResponse.json({ error: 'Revalidation is not configured' }, { status: 503 });
+    }
+    if (!secretsMatch(secret, revalidateSecret)) {
       return NextResponse.json({ error: 'Invalid secret' }, { status: 401 });
     }