fix(security): strip passwordHash from login responses, add invite TTL, add registration guard

- delete result.user.passwordHash before res.json in parent and kid login handlers
- add ALLOW_REGISTRATION=false env guard to /auth/register
- validateInvite now rejects codes older than 48h

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Author: jeet

src/server/modules/auth/routes.ts

@@ -65,6 +65,9 @@ authRouter.post('/auth/register', authLimiter, [
   body('name').isString().notEmpty(),
   validate
 ], async (req: Request, res: Response) => {
+  if (process.env.ALLOW_REGISTRATION === 'false') {
+    return res.status(403).json({ error: 'Registration is disabled' });
+  }
   try {
     const result = await authService.register(req.body.email, req.body.password, req.body.name);
     return res.json(result);
@@ -94,6 +97,7 @@ authRouter.post('/auth/login', authLimiter, [
   }
   clearAuthFailure(key);
   result.user.badges = JSON.parse(result.user.badges || "[]");
+  delete result.user.passwordHash;
   logSecurityEvent('auth.parent_login.success', { uid: result.user.uid, ip }, 'info');
   return res.json(result);
 });
@@ -119,6 +123,7 @@ authRouter.post('/auth/login/kid', authLimiter, [
   }
   clearAuthFailure(key);
   result.user.badges = JSON.parse(result.user.badges || "[]");
+  delete result.user.passwordHash;
   logSecurityEvent('auth.kid_login.success', { uid: result.user.uid, ip }, 'info');
   return res.json(result);
 });

src/server/modules/invites/service.ts

@@ -18,7 +18,8 @@ export const inviteService = {
   },
 
   validateInvite: (code: string) => {
-    return db.prepare("SELECT * FROM invites WHERE id = ? AND status = 'active'").get(code);
+    const ttlMs = 48 * 60 * 60 * 1000;
+    return db.prepare("SELECT * FROM invites WHERE id = ? AND status = 'active' AND createdAt > ?").get(code, Date.now() - ttlMs);
   },
 
   markInviteUsed: (code: string) => {