security: second-pass ownership checks + input validation fixes

- medication-profiles/[id]: verify familyId ownership before PATCH/DELETE
- event-templates/[id]: verify familyId ownership before PATCH/DELETE
- notify/push: verify baby.familyId matches session family before push
- events GET: validate type against ALL_EVENT_TYPES allowlist; sanitize
  limit (1–500) and offset (≥0) to prevent NaN/unbounded queries
- v1/summary: fix operator precedence bug in feeds count calculation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

SECURITY_AUDIT.md

@@ -11,10 +11,12 @@
 | Severity | Found | Fixed |
 |----------|-------|-------|
 | CRITICAL | 9     | 9     |
-| HIGH     | 6     | 5     |
+| HIGH     | 11    | 10    |
-| MEDIUM   | 6     | 2     |
+| MEDIUM   | 7     | 3     |
 | LOW      | 1     | 0     |
 
+_Updated after second-pass audit (pass 2 of 2)._
+
 ---
 
 ## CRITICAL — Fixed
@@ -145,6 +147,58 @@ If `SUPERADMIN_EMAIL` env var is not set, the condition `SUPERADMIN_EMAIL && ses
 
 ---
 
+---
+
+## HIGH — Fixed (pass 2)
+
+### 17. `medication-profiles/[id]` — no family ownership check
+**Affected:** PATCH and DELETE
+
+**Problem:** Any authenticated user could modify or delete any medication profile by ID.
+
+**Fix:** Added `prisma.medicationProfile.findFirst({ where: { id, familyId } })` check before PATCH and DELETE.
+
+---
+
+### 18. `event-templates/[id]` — no family ownership check
+**Affected:** PATCH and DELETE
+
+**Problem:** Any authenticated user could modify or delete any event template by ID.
+
+**Fix:** Added `prisma.eventTemplate.findFirst({ where: { id, familyId } })` check before PATCH and DELETE.
+
+---
+
+### 19. `notify/push` — no family ownership check on babyId
+**Problem:** Baby was fetched by ID but its `familyId` was never compared against the session user's family. Any authenticated user could trigger push notifications using another family's baby ID (leaking feeding status via the notification message).
+
+**Fix:** Added `if (baby.familyId !== sessionFamilyId) return 404`.
+
+---
+
+### 20. `events/route.ts` GET — event `type` not validated against allowlist
+**Problem:** The `type` query param was passed directly into the Prisma where clause without validation. While Prisma parameterizes values (no SQL injection), arbitrary strings could be stored and returned.
+
+**Fix:** Imported `ALL_EVENT_TYPES` from `event-config.ts` and added `if (type && !ALL_EVENT_TYPES.includes(type)) return 400`.
+
+---
+
+### 21. `events/route.ts` GET — `limit`/`offset` not sanitized
+**Problem:** `parseInt()` returns `NaN` on non-numeric input; `NaN` passed to Prisma `take`/`skip` causes an error or is treated as 0, potentially returning all rows.
+
+**Fix:** Added clamping: `limit = Math.max(1, Math.min(parseInt(limit) || 50, 500))`, `offset = Math.max(0, parseInt(offset) || 0)`.
+
+---
+
+## MEDIUM — Fixed (pass 2)
+
+### 22. `v1/summary` — arithmetic operator precedence bug
+**Problem:** `counts.BREASTFEED ?? 0 + (counts.BOTTLE ?? 0)` evaluated as `counts.BREASTFEED ?? (0 + (counts.BOTTLE ?? 0))` due to `??` precedence, causing incorrect feed count.
+
+**Fix:** Added explicit parentheses: `(counts.BREASTFEED ?? 0) + (counts.BOTTLE ?? 0)`.
+
+---
+
 ## Routes verified as already secure
 
 - `webhooks/route.ts` — familyId from session, no cross-family access possible

src/app/api/event-templates/[id]/route.ts

@@ -12,6 +12,11 @@ export async function PATCH(
   const { id } = await params;
   const body = await req.json();
 
+  const user = await prisma.user.findUnique({ where: { id: session.user.id }, select: { familyId: true } });
+  if (!user?.familyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
+  const owned = await prisma.eventTemplate.findFirst({ where: { id, familyId: user.familyId } });
+  if (!owned) return NextResponse.json({ error: "Introuvable" }, { status: 404 });
+
   const template = await prisma.eventTemplate.update({
     where: { id },
     data: {
@@ -33,6 +38,12 @@ export async function DELETE(
   if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
 
   const { id } = await params;
+
+  const delUser = await prisma.user.findUnique({ where: { id: session.user.id }, select: { familyId: true } });
+  if (!delUser?.familyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
+  const delOwned = await prisma.eventTemplate.findFirst({ where: { id, familyId: delUser.familyId } });
+  if (!delOwned) return NextResponse.json({ error: "Introuvable" }, { status: 404 });
+
   await prisma.eventTemplate.delete({ where: { id } });
   return new NextResponse(null, { status: 204 });
 }

src/app/api/events/route.ts

@@ -3,6 +3,7 @@ import { auth } from "@/lib/auth";
 import { prisma } from "@/lib/prisma";
 import { logAudit } from "@/lib/audit";
 import { dispatchWebhook } from "@/lib/webhooks";
+import { ALL_EVENT_TYPES } from "@/lib/event-config";
 
 export async function GET(req: Request) {
   const session = await auth();
@@ -10,9 +11,12 @@ export async function GET(req: Request) {
 
   const { searchParams } = new URL(req.url);
   const babyId = searchParams.get("babyId");
-  const limit = parseInt(searchParams.get("limit") ?? "50");
+  const limit = Math.max(1, Math.min(parseInt(searchParams.get("limit") ?? "50") || 50, 500));
-  const offset = parseInt(searchParams.get("offset") ?? "0");
+  const offset = Math.max(0, parseInt(searchParams.get("offset") ?? "0") || 0);
   const type = searchParams.get("type");
+  if (type && !ALL_EVENT_TYPES.includes(type as never)) {
+    return NextResponse.json({ error: "Type invalide" }, { status: 400 });
+  }
   const dateFrom = searchParams.get("dateFrom");
   const dateTo = searchParams.get("dateTo");
 

src/app/api/medication-profiles/[id]/route.ts

@@ -12,6 +12,11 @@ export async function PATCH(
   const { id } = await params;
   const body = await req.json();
 
+  const familyId = (session.user as { familyId?: string }).familyId;
+  if (!familyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
+  const owned = await prisma.medicationProfile.findFirst({ where: { id, familyId } });
+  if (!owned) return NextResponse.json({ error: "Introuvable" }, { status: 404 });
+
   const profile = await prisma.medicationProfile.update({
     where: { id },
     data: {
@@ -35,6 +40,12 @@ export async function DELETE(
   if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
 
   const { id } = await params;
+
+  const delFamilyId = (session.user as { familyId?: string }).familyId;
+  if (!delFamilyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
+  const delOwned = await prisma.medicationProfile.findFirst({ where: { id, familyId: delFamilyId } });
+  if (!delOwned) return NextResponse.json({ error: "Introuvable" }, { status: 404 });
+
   await prisma.medicationProfile.delete({ where: { id } });
   return new NextResponse(null, { status: 204 });
 }

src/app/api/notify/push/route.ts

@@ -16,6 +16,11 @@ export async function POST(req: Request) {
   });
   if (!baby) return NextResponse.json({ error: "Bébé introuvable" }, { status: 404 });
 
+  const sessionFamilyId = (session.user as { familyId?: string }).familyId;
+  if (!sessionFamilyId || baby.familyId !== sessionFamilyId) {
+    return NextResponse.json({ error: "Bébé introuvable" }, { status: 404 });
+  }
+
   const lastFeed = await prisma.event.findFirst({
     where: { babyId, type: { in: ["BREASTFEED", "BOTTLE"] } },
     orderBy: { startedAt: "desc" },

src/app/api/v1/summary/route.ts

@@ -36,7 +36,7 @@ export async function GET(req: Request) {
   return NextResponse.json({
     date: dayStart.toISOString().slice(0, 10),
     counts,
-    feeds: counts.BREASTFEED ?? 0 + (counts.BOTTLE ?? 0),
+    feeds: (counts.BREASTFEED ?? 0) + (counts.BOTTLE ?? 0),
     diapers: (counts.DIAPER_WET ?? 0) + (counts.DIAPER_STOOL ?? 0),
     sleepMinutes: Math.round(sleepMs / 60000),
     lastFeedAt: lastFeed ? lastFeed.startedAt : null,