Enforce admin CSRF, harden catalog translate, use CMS hotel name for PayPal.

Mutating withAdmin routes now require a double-submit CSRF token; translate is capped at 500 items with audit logging; PayPal descriptions prefer siteSettings hotel_name.

Co-authored-by: Cursor <[email protected]>

src/actions/catalog-items.ts

@@ -5,9 +5,11 @@ import { Prisma } from "@/generated/prisma/client";
 import { requirePermission } from "@/lib/admin/guard";
 import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
+import { logAudit } from "@/lib/services/audit";
 import { allocateCatalogItemId } from "@/lib/services/furni-import";
 import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";
+import { translateItemsSchema } from "@/lib/validators/catalog";
 
 const CATALOG_ITEM_FIELDS = [
 	"pageId",
@@ -323,13 +325,19 @@ export async function updateCatalogItem({
 	return { ok: true as const, data: {} };
 }
 
-export async function translateCatalogItems({
-	items,
-}: {
+export async function translateCatalogItems(input: {
 	/** `id` is items_base.id (not catalog_items.id) */
-	items: Array<{ id: number; publicName: string; description: string }>;
+	items: Array<{ id: number; publicName: string; description?: string }>;
 }) {
-	await requirePermission(PERMS.CATALOG_EDIT);
+	const staff = await requirePermission(PERMS.CATALOG_EDIT);
+	const parsed = translateItemsSchema.safeParse(input);
+	if (!parsed.success) {
+		return {
+			ok: false as const,
+			error: parsed.error.issues[0]?.message ?? "Invalid translate payload",
+		};
+	}
+	const { items } = parsed.data;
 	const { invalidateFurniDataCache } = await import(
 		"@/lib/services/catalog-items-loader"
 	);
@@ -413,6 +421,17 @@ export async function translateCatalogItems({
 	}
 
 	await rcon.updateCatalog();
+	await logAudit({
+		userId: staff.id,
+		action: "items_base_translate",
+		target: "ItemsBase",
+		after: {
+			namesUpdated,
+			descriptionsUpdated,
+			furniDataUpdated: furniResult.updated > 0,
+			furniDataInserted: furniResult.inserted,
+		},
+	});
 	revalidatePath("/admin/catalog");
 	return {
 		ok: true as const,

src/app/admin/import/clone/import-clone-client.tsx

@@ -19,6 +19,7 @@ import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { cn } from "@/lib/utils";
+import { adminFetch } from "@/lib/admin-fetch";
 
 // ── Types ─────────────────────────────────────────────────────────────────────
 
@@ -62,7 +63,7 @@ async function runSseImport(
 	onDone: (classname: string) => void,
 	onComplete: (succeeded: number, failed: number) => void,
 ): Promise<void> {
-	const res = await fetch(url, {
+	const res = await adminFetch(url, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify(body),
@@ -202,7 +203,7 @@ function SourcesManager({
 	async function handleSave(src: Partial<CloneSource>) {
 		setSaving(true);
 		try {
-			const res = await fetch("/api/admin/import/clone", {
+			const res = await adminFetch("/api/admin/import/clone", {
 				method: "POST",
 				headers: { "Content-Type": "application/json" },
 				body: JSON.stringify(src),
@@ -224,7 +225,7 @@ function SourcesManager({
 	async function handleDelete(src: CloneSource) {
 		setDeletingId(src.id);
 		try {
-			const res = await fetch(
+			const res = await adminFetch(
 				`/api/admin/import/clone?id=${encodeURIComponent(src.id)}`,
 				{
 					method: "DELETE",
@@ -417,7 +418,7 @@ function FurniGrid({ source }: FurniGridProps) {
 				});
 				if (search) params.set("search", search);
 				if (filterVal !== "all") params.set("filter", filterVal);
-				const res = await fetch(`/api/admin/import/clone?${params}`);
+				const res = await adminFetch(`/api/admin/import/clone?${params}`);
 				const data = await res.json();
 				if (!res.ok) {
 					setError(data.error || "Failed to load");
@@ -535,7 +536,7 @@ function FurniGrid({ source }: FurniGridProps) {
 	async function cloneAll() {
 		let names: string[] = [];
 		try {
-			const res = await fetch(
+			const res = await adminFetch(
 				`/api/admin/import/clone?source=${encodeURIComponent(source.id)}&action=clonable`,
 			);
 			const data = await res.json();
@@ -913,7 +914,7 @@ export function ImportCloneClient() {
 
 	const fetchSources = useCallback(async () => {
 		try {
-			const res = await fetch("/api/admin/import/clone?action=sources");
+			const res = await adminFetch("/api/admin/import/clone?action=sources");
 			const data = await res.json();
 			if (res.ok) {
 				setSources(data.sources || []);

src/app/admin/import/clothing/import-clothing-client.tsx

@@ -18,6 +18,7 @@ import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { cn } from "@/lib/utils";
 import { getAvatarUrl } from "@/lib/imager";
+import { adminFetch } from "@/lib/admin-fetch";
 
 // ── Shared types ─────────────────────────────────────────────────────────────
 
@@ -50,7 +51,7 @@ async function runSseImport(
 	onDone: (label: string) => void,
 	onComplete: (succeeded: number, failed: number) => void,
 ): Promise<void> {
-	const res = await fetch(url, {
+	const res = await adminFetch(url, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify(body),
@@ -155,7 +156,7 @@ function LibsView() {
 		try {
 			const params = new URLSearchParams({ page: String(pageNum) });
 			if (search) params.set("search", search);
-			const res = await fetch(`/api/admin/import/clothing?${params}`);
+			const res = await adminFetch(`/api/admin/import/clothing?${params}`);
 			const data = await res.json();
 			if (!res.ok) {
 				setError(data.error || "Failed to load");
@@ -251,7 +252,7 @@ function LibsView() {
 	async function remove(p: FigureItem) {
 		setBusyLib(p.lib);
 		try {
-			const res = await fetch(
+			const res = await adminFetch(
 				`/api/admin/import/clothing?lib=${encodeURIComponent(p.lib)}`,
 				{
 					method: "DELETE",
@@ -532,7 +533,7 @@ function SetsView() {
 		try {
 			const params = new URLSearchParams({ page: String(pageNum) });
 			if (search) params.set("search", search);
-			const res = await fetch(`/api/admin/import/clothing/sets?${params}`);
+			const res = await adminFetch(`/api/admin/import/clothing/sets?${params}`);
 			const data = await res.json();
 			if (!res.ok) {
 				setError(data.error || "Failed to load");

src/app/admin/import/effects/import-effects-client.tsx

@@ -19,6 +19,7 @@ import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { cn } from "@/lib/utils";
+import { adminFetch } from "@/lib/admin-fetch";
 
 interface EffectItem {
 	id: string;
@@ -50,7 +51,7 @@ export function ImportEffectsClient() {
 		try {
 			const params = new URLSearchParams();
 			if (search) params.set("search", search);
-			const res = await fetch(`/api/admin/import/effects?${params}`);
+			const res = await adminFetch(`/api/admin/import/effects?${params}`);
 			const data = await res.json();
 			if (!res.ok) {
 				setError(data.error || "Failed to load");
@@ -101,7 +102,7 @@ export function ImportEffectsClient() {
 
 	async function importViaSse(items: EffectItem[]) {
 		setBatchProgress({ done: 0, total: items.length });
-		const res = await fetch("/api/admin/import/effects/batch", {
+		const res = await adminFetch("/api/admin/import/effects/batch", {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
 			body: JSON.stringify({ items, concurrency: 3 }),
@@ -167,7 +168,7 @@ export function ImportEffectsClient() {
 	async function remove(e: EffectItem) {
 		setBusyLib(e.lib);
 		try {
-			const res = await fetch(
+			const res = await adminFetch(
 				`/api/admin/import/effects?lib=${encodeURIComponent(e.lib)}`,
 				{
 					method: "DELETE",

src/app/admin/import/furni/import-furni-client.tsx

@@ -52,6 +52,7 @@ import {
 	SelectValue,
 } from "@/components/ui/select";
 import { NitroEditorDialog } from "./nitro-editor-dialog";
+import { adminFetch } from "@/lib/admin-fetch";
 
 interface FurniItem {
 	id: number;
@@ -222,7 +223,7 @@ export function ImportFurniClient() {
 
 	const fetchStats = useCallback(async () => {
 		try {
-			const res = await fetch("/api/admin/import/furni?action=stats");
+			const res = await adminFetch("/api/admin/import/furni?action=stats");
 			const data = await res.json();
 			if (res.ok) {
 				setStats({
@@ -327,7 +328,7 @@ export function ImportFurniClient() {
 				if (status === "missing-nitro") {
 					params.set("action", "missing-nitro");
 				}
-				const res = await fetch(`/api/admin/import/furni?${params}`);
+				const res = await adminFetch(`/api/admin/import/furni?${params}`);
 				const data = await res.json();
 				if (!res.ok) {
 					setError(data.error || "Failed to load");
@@ -417,7 +418,7 @@ export function ImportFurniClient() {
 	async function doImport(item: FurniItem) {
 		setImportingId(item.classname);
 		try {
-			const res = await fetch("/api/admin/import/furni", {
+			const res = await adminFetch("/api/admin/import/furni", {
 				method: "POST",
 				headers: { "Content-Type": "application/json" },
 				body: JSON.stringify({
@@ -483,7 +484,7 @@ export function ImportFurniClient() {
 		setBatchProgress(new Map(initialProgress));
 
 		try {
-			const res = await fetch("/api/admin/import/furni/batch", {
+			const res = await adminFetch("/api/admin/import/furni/batch", {
 				method: "POST",
 				headers: { "Content-Type": "application/json" },
 				body: JSON.stringify({
@@ -590,7 +591,7 @@ export function ImportFurniClient() {
 	async function regenNitro(item: FurniItem) {
 		setRegeneratingNitro((prev) => new Set(prev).add(item.classname));
 		try {
-			const res = await fetch("/api/admin/import/furni", {
+			const res = await adminFetch("/api/admin/import/furni", {
 				method: "PATCH",
 				headers: { "Content-Type": "application/json" },
 				body: JSON.stringify({
@@ -640,7 +641,7 @@ export function ImportFurniClient() {
 		setRegenProgress(new Map(initialProgress));
 
 		try {
-			const res = await fetch("/api/admin/import/furni/batch-regen", {
+			const res = await adminFetch("/api/admin/import/furni/batch-regen", {
 				method: "POST",
 				headers: { "Content-Type": "application/json" },
 				body: JSON.stringify({
@@ -753,7 +754,7 @@ export function ImportFurniClient() {
 	async function startReorganize() {
 		setReorganizing(true);
 		try {
-			const previewRes = await fetch("/api/admin/import/furni?dryrun=1", {
+			const previewRes = await adminFetch("/api/admin/import/furni?dryrun=1", {
 				method: "PUT",
 			});
 			const previewData = await previewRes.json();
@@ -779,7 +780,7 @@ export function ImportFurniClient() {
 		setReorgPreview(null);
 		setReorganizing(true);
 		try {
-			const res = await fetch("/api/admin/import/furni", { method: "PUT" });
+			const res = await adminFetch("/api/admin/import/furni", { method: "PUT" });
 			const d = await res.json();
 			if (res.ok) {
 				const parts: string[] = [];

src/app/admin/import/furni/nitro-editor-dialog.tsx

@@ -31,6 +31,7 @@ import { Label } from "@/components/ui/label";
 import { Switch } from "@/components/ui/switch";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { Textarea } from "@/components/ui/textarea";
+import { adminFetch } from "@/lib/admin-fetch";
 
 interface NitroEditorDialogProps {
 	classname: string;
@@ -121,7 +122,7 @@ export function NitroEditorDialog({
 		setLoading(true);
 		setJsonError(null);
 		try {
-			const res = await fetch(
+			const res = await adminFetch(
 				`/api/admin/import/furni/nitro-editor?classname=${encodeURIComponent(classname)}`,
 			);
 			if (!res.ok) {
@@ -189,7 +190,7 @@ export function NitroEditorDialog({
 
 		setSaving(true);
 		try {
-			const res = await fetch("/api/admin/import/furni/nitro-editor", {
+			const res = await adminFetch("/api/admin/import/furni/nitro-editor", {
 				method: "PUT",
 				headers: { "Content-Type": "application/json" },
 				body: JSON.stringify({

src/app/admin/import/pets/import-pets-client.tsx

@@ -17,6 +17,7 @@ import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { cn } from "@/lib/utils";
+import { adminFetch } from "@/lib/admin-fetch";
 
 interface PetItem {
 	lib: string;
@@ -57,7 +58,7 @@ export function ImportPetsClient() {
 		try {
 			const params = new URLSearchParams();
 			if (search) params.set("search", search);
-			const res = await fetch(`/api/admin/import/pets?${params}`);
+			const res = await adminFetch(`/api/admin/import/pets?${params}`);
 			const data = await res.json();
 			if (!res.ok) {
 				setError(data.error || "Failed to load");
@@ -99,7 +100,7 @@ export function ImportPetsClient() {
 
 	async function importViaSse(items: PetItem[]) {
 		setBatchProgress({ done: 0, total: items.length });
-		const res = await fetch("/api/admin/import/pets/batch", {
+		const res = await adminFetch("/api/admin/import/pets/batch", {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
 			body: JSON.stringify({ items, concurrency: 3 }),
@@ -161,7 +162,7 @@ export function ImportPetsClient() {
 	async function remove(p: PetItem) {
 		setBusyLib(p.lib);
 		try {
-			const res = await fetch(
+			const res = await adminFetch(
 				`/api/admin/import/pets?lib=${encodeURIComponent(p.lib)}`,
 				{
 					method: "DELETE",

src/app/admin/layout.tsx

@@ -11,6 +11,7 @@ import { LanguageSwitcher } from "@/components/language-switcher";
 import { ThemeSwitcher } from "@/components/theme-switcher";
 import { requireStaff } from "@/lib/admin/guard";
 import { ADMIN_NAV_GROUPS } from "@/lib/admin-nav";
+import { setCsrfCookie } from "@/lib/foundation/security";
 import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 
@@ -22,6 +23,7 @@ export default async function AdminLayout({
 	children: ReactNode;
 }) {
 	const staff = await requireStaff();
+	const csrfToken = await setCsrfCookie();
 	if (await siteSettings.getBool("force_staff_2fa", false)) {
 		const u = await prisma.user
 			.findUnique({
@@ -33,18 +35,21 @@ export default async function AdminLayout({
 	}
 
 	return (
-		<AdminMobileWrapper sidebar={<Sidebar staff={staff} />}>
-			<div
-				data-admin
-				className="flex flex-col min-w-0 p-5 lg:p-6 min-h-screen"
-				style={{ backgroundColor: "var(--admin-canvas)" }}
-			>
-				<AdminTopbar staff={staff} />
-				<section className="admin-page flex-1">
-					<AdminHubChrome>{children}</AdminHubChrome>
-				</section>
-			</div>
-		</AdminMobileWrapper>
+		<>
+			<meta name="csrf-token" content={csrfToken} />
+			<AdminMobileWrapper sidebar={<Sidebar staff={staff} />}>
+				<div
+					data-admin
+					className="flex flex-col min-w-0 p-5 lg:p-6 min-h-screen"
+					style={{ backgroundColor: "var(--admin-canvas)" }}
+				>
+					<AdminTopbar staff={staff} />
+					<section className="admin-page flex-1">
+						<AdminHubChrome>{children}</AdminHubChrome>
+					</section>
+				</div>
+			</AdminMobileWrapper>
+		</>
 	);
 }
 

src/app/admin/sounds/sounds-client.tsx

@@ -46,6 +46,7 @@ import { useServerAction } from "@/hooks/use-server-action";
 import { invalidateSongPickerCache } from "@/lib/client-cache/song-picker-cache";
 import { parseTraxChannels } from "@/lib/trax-format";
 import { TraxPlayer } from "./trax-player";
+import { adminFetch } from "@/lib/admin-fetch";
 
 interface SoundtrackRow {
 	id: number;
@@ -434,7 +435,7 @@ function UploadDialog({
 		fd.append("author", author.trim());
 
 		try {
-			const res = await fetch("/api/admin/sounds/upload", {
+			const res = await adminFetch("/api/admin/sounds/upload", {
 				method: "POST",
 				body: fd,
 			});

src/app/api/paypal/capture/route.ts

@@ -19,6 +19,7 @@ import {
 } from "@/lib/services/paypal-topup";
 import { rcon } from "@/lib/services/rcon";
 import { sendCurrency } from "@/lib/services/send-currency";
+import { siteSettings } from "@/lib/services/site-settings";
 
 export const dynamic = "force-dynamic";
 
@@ -157,6 +158,9 @@ export async function POST(req: Request): Promise<Response> {
 		);
 	}
 
+	const hotelName =
+		(await siteSettings.get("hotel_name", env.HOTEL_NAME)) ?? env.HOTEL_NAME;
+
 	if (result.status !== "COMPLETED") {
 		// Record the non-completed attempt so support can trace it.
 		try {
@@ -164,7 +168,7 @@ export async function POST(req: Request): Promise<Response> {
 				where: { userId, transactionId: orderId, status: "CREATED" },
 				data: {
 					status: result.status,
-					description: `${env.HOTEL_NAME} top-up (not completed)`,
+					description: `${hotelName} top-up (not completed)`,
 					amount: result.amount,
 					currency: result.currency,
 					createdAt: new Date(),
@@ -189,7 +193,7 @@ export async function POST(req: Request): Promise<Response> {
 			where: { userId, transactionId: orderId, status: "CREATED" },
 			data: {
 				status: "CAPTURED_PENDING_CREDIT",
-				description: `${env.HOTEL_NAME} top-up: ${credits} credits`,
+				description: `${hotelName} top-up: ${credits} credits`,
 				amount: result.amount,
 				currency: result.currency,
 				createdAt: new Date(),

src/app/api/paypal/create/route.ts

@@ -11,6 +11,7 @@ import {
 	PAYPAL_CURRENCY,
 } from "@/lib/services/paypal";
 import { recordCreatedTopup } from "@/lib/services/paypal-topup";
+import { siteSettings } from "@/lib/services/site-settings";
 
 export const dynamic = "force-dynamic";
 
@@ -68,10 +69,12 @@ export async function POST(req: Request): Promise<Response> {
 
 	const credits = Math.floor(amount * creditsPerUnit());
 	const base = env.APP_URL.replace(/\/+$/, "");
+	const hotelName =
+		(await siteSettings.get("hotel_name", env.HOTEL_NAME)) ?? env.HOTEL_NAME;
 
 	try {
 		const order = await createOrder(amount, {
-			description: `${env.HOTEL_NAME} top-up: ${credits} credits`,
+			description: `${hotelName} top-up: ${credits} credits`,
 			returnUrl: `${base}/shop/topup?status=success`,
 			cancelUrl: `${base}/shop/topup?status=cancel`,
 		});

src/components/admin/catalog-tree.tsx

@@ -52,6 +52,7 @@ import {
 } from "@/components/ui/tooltip";
 import { translateCaption } from "@/lib/catalog-translations";
 import { cn } from "@/lib/utils";
+import { adminFetch } from "@/lib/admin-fetch";
 
 /* ─── Types ──────────────────────────────────────────────── */
 
@@ -211,7 +212,7 @@ export function CatalogTree({
 			setSearching(true);
 			try {
 				const catParam = catalogType === "bc" ? "&catalog=bc" : "";
-				const res = await fetch(
+				const res = await adminFetch(
 					`/api/admin/catalog/tree?search=${encodeURIComponent(searchQuery.trim())}${catParam}`,
 				);
 				if (res.ok) {
@@ -237,7 +238,7 @@ export function CatalogTree({
 	const handleToggleEnabled = useCallback(
 		async (node: TreeNode) => {
 			try {
-				const res = await fetch("/api/admin/catalog/tree", {
+				const res = await adminFetch("/api/admin/catalog/tree", {
 					method: "PATCH",
 					headers: { "Content-Type": "application/json" },
 					body: `{"pageId":${node.id},"toggleField":"toggleEnabled"${catBody}}`,
@@ -257,7 +258,7 @@ export function CatalogTree({
 	const handleToggleVisible = useCallback(
 		async (node: TreeNode) => {
 			try {
-				const res = await fetch("/api/admin/catalog/tree", {
+				const res = await adminFetch("/api/admin/catalog/tree", {
 					method: "PATCH",
 					headers: { "Content-Type": "application/json" },
 					body: `{"pageId":${node.id},"toggleField":"toggleVisible"${catBody}}`,
@@ -290,7 +291,7 @@ export function CatalogTree({
 			if (!ok) return;
 
 			try {
-				const res = await fetch(
+				const res = await adminFetch(
 					`/api/admin/catalog/tree?pageId=${node.id}&mode=reparent${catParam}`,
 					{
 						method: "DELETE",
@@ -571,7 +572,7 @@ function TreeItem({
 		setLoading(true);
 		try {
 			const catParam = catalogType === "bc" ? "&catalog=bc" : "";
-			const res = await fetch(
+			const res = await adminFetch(
 				`/api/admin/catalog/tree?parentId=${node.id}${catParam}`,
 			);
 			if (res.ok) {

src/lib/admin-fetch.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, it } from "vitest";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+describe("admin CSRF wiring", () => {
+	it("defaults CSRF on for mutating withAdmin handlers", () => {
+		const source = readFileSync(
+			resolve(process.cwd(), "src/lib/api-handler.ts"),
+			"utf8",
+		);
+		expect(source).toContain("options.requireCsrf !== false");
+	});
+
+	it("issues a csrf meta tag from the admin layout", () => {
+		const source = readFileSync(
+			resolve(process.cwd(), "src/app/admin/layout.tsx"),
+			"utf8",
+		);
+		expect(source).toContain("setCsrfCookie");
+		expect(source).toContain('meta name="csrf-token"');
+	});
+
+	it("provides adminFetch helper that sets x-csrf-token", () => {
+		const source = readFileSync(
+			resolve(process.cwd(), "src/lib/admin-fetch.ts"),
+			"utf8",
+		);
+		expect(source).toContain("x-csrf-token");
+		expect(source).toContain("getCsrfToken");
+	});
+});

src/lib/admin-fetch.ts

@@ -0,0 +1,31 @@
+const MUTATING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+
+/** Read the CSRF token injected by the admin layout `<meta name="csrf-token">`. */
+export function getCsrfToken(): string | null {
+	if (typeof document === "undefined") return null;
+	return (
+		document
+			.querySelector('meta[name="csrf-token"]')
+			?.getAttribute("content") ?? null
+	);
+}
+
+/**
+ * Same-origin fetch for admin APIs. Attaches `x-csrf-token` on mutating methods.
+ */
+export function adminFetch(
+	input: RequestInfo | URL,
+	init?: RequestInit,
+): Promise<Response> {
+	const method = (init?.method ?? "GET").toUpperCase();
+	const headers = new Headers(init?.headers);
+	if (MUTATING.has(method)) {
+		const token = getCsrfToken();
+		if (token) headers.set("x-csrf-token", token);
+	}
+	return fetch(input, {
+		...init,
+		headers,
+		credentials: init?.credentials ?? "same-origin",
+	});
+}

src/lib/api-handler.ts

@@ -25,7 +25,10 @@ export function withAdmin(
 	handler: AdminHandler,
 ) {
 	return async (request: NextRequest, routeContext: RouteContext = {}) => {
-		if (options.requireCsrf === true && MUTATING_METHODS.has(request.method)) {
+		// CSRF required for mutating admin APIs unless explicitly opted out.
+		const csrfRequired =
+			options.requireCsrf !== false && MUTATING_METHODS.has(request.method);
+		if (csrfRequired) {
 			const csrfToken =
 				request.headers.get("x-csrf-token") ??
 				request.headers.get("csrf-token") ??

src/lib/foundation/security.ts

@@ -5,9 +5,15 @@ import { env } from "@/env";
 import type { IpAddress } from "./types";
 
 const CSRF_BYTES = 32;
-const CSRF_COOKIE = "__Host-csrf-token";
 const CSRF_COOKIE_MAX_AGE = 86400; // 24h
 
+/** `__Host-` requires Secure; use a plain name on non-HTTPS local dev. */
+function csrfCookieName(): string {
+	return process.env.NODE_ENV === "production"
+		? "__Host-csrf-token"
+		: "csrf-token";
+}
+
 const ALLOWED_HOSTS: ReadonlySet<string> = new Set(
 	[
 		env.APP_URL ? new URL(env.APP_URL).host : "",
@@ -58,7 +64,7 @@ export function redirectSafe(
 	redirect(safeRedirect(destination, fallback));
 }
 
-function csrfCookieOpts(): {
+function csrfCookieOpts(value: string): {
 	name: string;
 	value: string;
 	httpOnly: boolean;
@@ -67,11 +73,12 @@ function csrfCookieOpts(): {
 	path: string;
 	maxAge: number;
 } {
+	const isProd = process.env.NODE_ENV === "production";
 	return {
-		name: CSRF_COOKIE,
-		value: crypto.randomBytes(CSRF_BYTES).toString("hex"),
+		name: csrfCookieName(),
+		value,
 		httpOnly: true,
-		secure: true,
+		secure: isProd,
 		sameSite: "lax" as const,
 		path: "/",
 		maxAge: CSRF_COOKIE_MAX_AGE,
@@ -80,19 +87,21 @@ function csrfCookieOpts(): {
 
 export async function setCsrfCookie(): Promise<string> {
 	const c = await cookies();
-	const existing = c.get(CSRF_COOKIE);
+	const name = csrfCookieName();
+	const existing = c.get(name);
 	if (existing?.value && existing.value.length === CSRF_BYTES * 2)
 		return existing.value;
-	const opts = csrfCookieOpts();
+	const value = crypto.randomBytes(CSRF_BYTES).toString("hex");
+	const opts = csrfCookieOpts(value);
 	c.set(opts.name, opts.value, opts);
-	return opts.value;
+	return value;
 }
 
 export async function validateCsrfToken(token: string): Promise<boolean> {
 	if (!token || token.length !== CSRF_BYTES * 2) return false;
 	try {
 		const c = await cookies();
-		const stored = c.get(CSRF_COOKIE)?.value;
+		const stored = c.get(csrfCookieName())?.value;
 		if (!stored || stored.length !== CSRF_BYTES * 2) return false;
 		return crypto.timingSafeEqual(Buffer.from(token), Buffer.from(stored));
 	} catch {

src/lib/validators/catalog.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, it } from "vitest";
+import { translateItemsSchema } from "@/lib/validators/catalog";
+
+describe("translateItemsSchema", () => {
+	it("accepts a valid payload", () => {
+		const parsed = translateItemsSchema.safeParse({
+			items: [{ id: 1, publicName: "Chair", description: "A chair" }],
+		});
+		expect(parsed.success).toBe(true);
+	});
+
+	it("rejects more than 500 items", () => {
+		const items = Array.from({ length: 501 }, (_, i) => ({
+			id: i + 1,
+			publicName: `Item ${i + 1}`,
+		}));
+		const parsed = translateItemsSchema.safeParse({ items });
+		expect(parsed.success).toBe(false);
+	});
+
+	it("rejects oversized public names", () => {
+		const parsed = translateItemsSchema.safeParse({
+			items: [{ id: 1, publicName: "x".repeat(256) }],
+		});
+		expect(parsed.success).toBe(false);
+	});
+});

src/lib/validators/catalog.ts

@@ -0,0 +1,16 @@
+import { z } from "zod";
+
+export const translateItemsSchema = z.object({
+	items: z
+		.array(
+			z.object({
+				id: z.coerce.number().int().positive(),
+				publicName: z.string().min(1, "Name is required").max(255),
+				description: z.string().max(1000).optional().default(""),
+			}),
+		)
+		.min(1, "At least one item required")
+		.max(500),
+});
+
+export type TranslateItemsInput = z.infer<typeof translateItemsSchema>;