security

Security Patterns

1. Authentication

Current State

• Frontend: Logto (OAuth/OIDC) handles user sessions
• Backend: protectedProcedure exists but NEVER used
• All 15 routers use publicProcedure (INSECURE for user data)

Code: protectedProcedure vs publicProcedure

// CURRENT (INSECURE) - used everywhere in this codebase
export const userRouter = router({
  getProfile: publicProcedure
    .input(z.object({ userId: z.string() }))
    .query(({ input }) => {
      // ❌ Anyone can access any user's profile!
      return prisma.user.findUnique({ where: { id: input.userId } });
    }),
});

// SHOULD BE - using protectedProcedure
export const userRouter = router({
  getMyProfile: protectedProcedure
    .query(({ ctx }) => {
      // ✅ Only authenticated users can access
      // ctx.user is guaranteed to be populated
      return prisma.user.findUnique({ where: { id: ctx.user.id } });
    }),
});

Auth Context (trpc.ts)

// Current state - ctx.user is ALWAYS null!
export const createContext = async ({ req, res }) => {
  return {
    req,
    res,
    prisma,
    user: null, // Will be populated when token verification is implemented
  };
};

// Protected procedure always throws UNAUTHORIZED
export const protectedProcedure = t.procedure.use(async function isAuthed(opts) {
  const { ctx } = opts;
  if (!ctx.user) {
    throw new TRPCError({ code: 'UNAUTHORIZED' });
  }
  return opts.next({ ctx: { user: ctx.user } });
});

Rules

• ✅ Use protectedProcedure for any user-specific data
• ✅ Use publicProcedure only for truly public data (game info, item catalogs)
• ❌ NEVER use publicProcedure for: user profiles, settings, private data, mutations

---

2. Input Validation

Current Approach

• Zod on ALL inputs (this is good)
• Example patterns from codebase:

// String with length limits
z.string().min(3).max(80)
z.string().email()
z.string().uuid()
z.string().optional()

// Numbers with bounds  
z.number().min(1).max(100)
z.number().min(1).max(50).default(20)

// Booleans with defaults
z.boolean().default(false)

// Enums for fixed values
z.enum(['OPEN', 'CLOSED', 'IN_PROGRESS'])
z.enum(['RANKED', 'CASUAL', 'CUSTOM', 'TOURNAMENT'])

// Arrays
z.array(z.string())
z.array(z.string()).min(1)

// Objects with nested validation
z.object({
  user: z.object({
    id: z.string(),
    username: z.string().optional(),
    avatarUrl: z.string().optional(),
    avatarConfig: z.record(z.string(), z.any()).optional(),
    isGuest: z.boolean().default(false),
  })
})

// Nullable and optional
z.string().nullable()
z.string().optional()
z.string().optional().nullable()