Harden auth, payments, and frontend against review findings.

Close exploitable gaps in booking/payment flows, enforce token versioning and account checks, gate sensitive payment data, and add middleware plus input validation across admin routes.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/context/AuthContext.tsx

@@ -44,6 +44,17 @@ const AuthContext = createContext<AuthContextType | undefined>(undefined);
 
 const TOKEN_KEY = 'spanglish-token';
 const USER_KEY = 'spanglish-user';
+const AUTH_COOKIE = 'spanglish-auth';
+
+function setAuthCookie() {
+  if (typeof document === 'undefined') return;
+  document.cookie = `${AUTH_COOKIE}=1; path=/; max-age=${60 * 60 * 24}; SameSite=Lax`;
+}
+
+function clearAuthCookie() {
+  if (typeof document === 'undefined') return;
+  document.cookie = `${AUTH_COOKIE}=; path=/; max-age=0; SameSite=Lax`;
+}
 
 export function AuthProvider({ children }: { children: ReactNode }) {
   const [user, setUser] = useState<User | null>(null);
@@ -66,12 +77,14 @@ export function AuthProvider({ children }: { children: ReactNode }) {
         const data = await res.json();
         setUser(data.user);
         localStorage.setItem(USER_KEY, JSON.stringify(data.user));
+        setAuthCookie();
       } else if (res.status === 401) {
         // Token is invalid, clear auth state
         setToken(null);
         setUser(null);
         localStorage.removeItem(TOKEN_KEY);
         localStorage.removeItem(USER_KEY);
+        clearAuthCookie();
       }
     } catch (error) {
       // Network error, keep using cached data
@@ -85,10 +98,24 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     const savedUser = localStorage.getItem(USER_KEY);
     
     if (savedToken && savedUser) {
-      setToken(savedToken);
-      setUser(JSON.parse(savedUser));
-      // Refresh user data from server to get latest role/permissions
-      refreshUser().finally(() => setIsLoading(false));
+      // Guard against corrupt/tampered localStorage so the whole app doesn't crash.
+      let parsedUser: User | null = null;
+      try {
+        parsedUser = JSON.parse(savedUser);
+      } catch {
+        parsedUser = null;
+      }
+
+      if (parsedUser) {
+        setToken(savedToken);
+        setUser(parsedUser);
+        // Refresh user data from server to get latest role/permissions (source of truth)
+        refreshUser().finally(() => setIsLoading(false));
+      } else {
+        localStorage.removeItem(TOKEN_KEY);
+        localStorage.removeItem(USER_KEY);
+        setIsLoading(false);
+      }
     } else {
       setIsLoading(false);
     }
@@ -99,6 +126,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     setUser(data.user);
     localStorage.setItem(TOKEN_KEY, data.token);
     localStorage.setItem(USER_KEY, JSON.stringify(data.user));
+    setAuthCookie();
   }, []);
 
   const login = async (email: string, password: string) => {
@@ -166,10 +194,21 @@ export function AuthProvider({ children }: { children: ReactNode }) {
   };
 
   const logout = useCallback(() => {
+    // Best-effort server-side invalidation (bumps token version so the JWT can't be reused).
+    const currentToken = localStorage.getItem(TOKEN_KEY);
+    if (currentToken) {
+      fetch(`${API_BASE}/api/auth/logout`, {
+        method: 'POST',
+        headers: { 'Authorization': `Bearer ${currentToken}` },
+      }).catch(() => {
+        // Ignore network errors; local state is cleared regardless.
+      });
+    }
     setToken(null);
     setUser(null);
     localStorage.removeItem(TOKEN_KEY);
     localStorage.removeItem(USER_KEY);
+    clearAuthCookie();
   }, []);
 
   const updateUser = useCallback((updatedUser: User) => {