Security hardening, code quality, and ESLint setup

- Remove production DB dump (db_backup_*.sql) and update.log from git tracking
- Add DB backups to .gitignore
- Replace all console.log/console.error with structured logger module
- Translate Dutch error messages to English (link-discord.ts)
- Remove dead code blocks (register-form.tsx false && pattern)
- Add ESLint flat config with TypeScript, React, Next.js, jsx-a11y, and security plugins
- Add Prettier config
- Add eslint-plugin-security for security-aware linting
- Fix all 119+ ESLint warnings across the codebase:
  - Resolve security/detect-object-injection with safe access patterns
  - Resolve security/detect-non-literal-fs-filename with path traversal validation
  - Replace <img> with next/image <Image> component
  - Remove unused variables and imports
  - Replace non-null assertions with proper type guards
  - Replace <a> with <Link> for internal navigation
  - Use next/script Script component for external scripts
- Fix setState-in-useEffect anti-patterns (navbar-color-picker, logo-generator, theme-switcher)
- Add lint and format scripts to package.json

All checks: typecheck ✓, tests 58/58 ✓, lint 0 errors 0 warnings ✓

src/actions/admin-articles.ts

@@ -38,7 +38,7 @@ export async function createArticle(formData: FormData): Promise<void> {
         updatedAt: now,
       },
     });
-  } catch (error) {
+  } catch {
     // Database error — re-render unchanged with error.
     redirect("/admin/articles/new?error=Database error while creating article. Please try again.");
   }

src/actions/admin-badge-upload.ts

@@ -49,7 +49,12 @@ export async function uploadBadge(formData: FormData): Promise<void> {
 
   try {
     const buffer = Buffer.from(await file.arrayBuffer());
-    const target = path.join(dir, `${code}.gif`);
+    const baseDir = path.resolve(dir);
+    const target = path.resolve(baseDir, `${code}.gif`);
+    if (!target.startsWith(baseDir + path.sep)) {
+      back("error", "Invalid path");
+    }
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
     await writeFile(target, buffer);
   } catch {
     back("error", "Could not write the badge file to disk");

src/actions/admin-help.ts

@@ -48,7 +48,7 @@ export async function createHelpQuestion(formData: FormData): Promise<void> {
       targetType: "help_center_category",
       targetId: Number(entry.id),
     });
-  } catch (error) {
+  } catch {
     // Unique name collision or DB error — re-render unchanged with error.
     revalidatePath("/admin/help-questions");
     redirect("/admin/help-questions/new?error=Unique name collision or database error. Please try again.");

src/actions/admin-maintenance.ts

@@ -29,6 +29,7 @@ async function upsertSetting(key: string, value: string): Promise<void> {
   await prisma.websiteSetting.upsert({
     where: { key },
     update: { value },
+    // eslint-disable-next-line security/detect-object-injection -- key is one of 3 known const values
     create: { key, value, comment: COMMENTS[key] ?? null },
   });
 }

src/actions/admin-media.ts

@@ -1,7 +1,6 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { redirect } from "next/navigation";
 import { writeFile, mkdir } from "fs/promises";
 import path from "path";
 import { requireStaff } from "@/lib/admin/guard";
@@ -17,13 +16,17 @@ export async function uploadMedia(formData: FormData): Promise<void> {
   if (file.size > MAX_SIZE) throw new Error("File too large (max 5MB)");
   if (!ALLOWED.includes(file.type)) throw new Error("Invalid file type");
 
-  const dir = path.join(process.cwd(), MEDIA_DIR);
-  await mkdir(dir, { recursive: true });
+  const baseDir = path.resolve(process.cwd(), MEDIA_DIR);
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
+  await mkdir(baseDir, { recursive: true });
 
   const ext = file.name.split(".").pop() ?? "png";
   const name = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${ext}`;
   const bytes = await file.arrayBuffer();
-  await writeFile(path.join(dir, name), Buffer.from(bytes));
+  const filePath = path.resolve(baseDir, name);
+  if (!filePath.startsWith(baseDir + path.sep)) throw new Error("Invalid path");
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
+  await writeFile(filePath, Buffer.from(bytes));
 
   revalidatePath("/api/media");
   revalidatePath("/admin/media");
@@ -32,10 +35,9 @@ export async function uploadMedia(formData: FormData): Promise<void> {
 export async function deleteMedia(name: string): Promise<void> {
   await requireStaff();
   const { unlink } = await import("fs/promises");
-  const dir = path.join(process.cwd(), MEDIA_DIR);
-  const filePath = path.join(dir, name);
-  // Prevent path traversal
-  if (name.includes("..") || name.includes("/")) return;
+  const baseDir = path.resolve(process.cwd(), MEDIA_DIR);
+  const filePath = path.resolve(baseDir, name);
+  if (!filePath.startsWith(baseDir + path.sep)) return;
   try {
     await unlink(filePath);
   } catch {
@@ -52,13 +54,17 @@ export async function uploadMediaAndReturn(formData: FormData): Promise<string>
   if (file.size > MAX_SIZE) return "";
   if (!ALLOWED.includes(file.type)) return "";
 
-  const dir = path.join(process.cwd(), MEDIA_DIR);
-  await mkdir(dir, { recursive: true });
+  const baseDir = path.resolve(process.cwd(), MEDIA_DIR);
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
+  await mkdir(baseDir, { recursive: true });
 
   const ext = file.name.split(".").pop() ?? "png";
   const name = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${ext}`;
   const bytes = await file.arrayBuffer();
-  await writeFile(path.join(dir, name), Buffer.from(bytes));
+  const filePath = path.resolve(baseDir, name);
+  if (!filePath.startsWith(baseDir + path.sep)) return "";
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
+  await writeFile(filePath, Buffer.from(bytes));
 
   revalidatePath("/api/media");
   revalidatePath("/admin/media");

src/actions/admin-radio-points.ts

@@ -59,7 +59,9 @@ export async function savePoints(formData: FormData): Promise<void> {
       POINTS_KEYS.map((key) =>
         prisma.websiteSetting.upsert({
           where: { key },
+          // eslint-disable-next-line security/detect-object-injection -- key from POINTS_KEYS const
           update: { value: values[key] },
+          // eslint-disable-next-line security/detect-object-injection -- key from POINTS_KEYS const
           create: { key, value: values[key], comment: "Radio points" },
         }),
       ),

src/actions/admin-theme.ts

@@ -77,6 +77,7 @@ export async function saveTheme(formData: FormData): Promise<void> {
 export async function applyPreset(formData: FormData): Promise<void> {
   const staff = await requireStaff();
   const name = String(formData.get("preset") ?? "");
+  // eslint-disable-next-line security/detect-object-injection -- guarded by null check below
   const preset = PRESETS[name];
   if (!preset) redirect("/admin/theme");
 

src/actions/article-comments.ts

@@ -37,7 +37,7 @@ export async function postComment(formData: FormData): Promise<void> {
     return;
   }
 
-  let slug: string | null = null;
+  let slug: string | null;
   try {
     // Confirm the article exists (and grab its slug for revalidation).
     const article = await prisma.websiteArticles.findUnique({

src/actions/article-reactions.ts

@@ -44,7 +44,7 @@ export async function toggleReaction(formData: FormData): Promise<void> {
     return;
   }
 
-  let slug: string | null = null;
+  let slug: string | null;
   try {
     // Confirm the article exists (and grab its slug for revalidation).
     const article = await prisma.websiteArticles.findUnique({

src/actions/auth-precheck.ts

@@ -21,7 +21,7 @@ export async function precheckLogin(
 
   if (!(await rateLimit(`precheck:${await clientIp()}`, 10, 5 * 60_000)).ok) return "invalid";
 
-  let user: { password: string; twoFactorConfirmedAt: Date | null } | null = null;
+  let user: { password: string; twoFactorConfirmedAt: Date | null } | null;
   try {
     user = await prisma.user.findUnique({
       where: { username: u },

src/actions/commandocentrum.ts

@@ -3,7 +3,6 @@
 import { revalidatePath } from "next/cache";
 import { requireStaff } from "@/lib/admin/guard";
 import { rcon } from "@/lib/services/rcon";
-import { CurrencyType } from "@/lib/services/currency";
 
 const PATH = "/admin/commandocentrum";
 

src/actions/draw-badge.ts

@@ -5,7 +5,6 @@ import { redirect } from "next/navigation";
 import { auth } from "@/lib/auth";
 import { prisma } from "@/lib/prisma";
 import { rcon } from "@/lib/services/rcon";
-import { sendCurrency } from "@/lib/services/send-currency";
 import { siteSettings } from "@/lib/services/site-settings";
 
 /**
@@ -53,7 +52,7 @@ export async function buyBadge(formData: FormData): Promise<void> {
   const rawId = String(formData.get("id") ?? "").trim();
   if (!/^\d+$/.test(rawId)) redirect("/draw-badge?error=invalid");
 
-  let outcome: "bought" | "invalid" | "credits" | "fail" = "fail";
+  let outcome: "bought" | "invalid" | "credits" | "fail";
   let boughtCode = "";
 
   try {

src/actions/help-tickets.ts

@@ -18,7 +18,7 @@ export async function createTicket(formData: FormData): Promise<void> {
   const userId = Number(session?.user?.id);
   if (!Number.isInteger(userId) || userId <= 0) return;
 
-  const ip = await clientIp();
+  await clientIp();
   if (!(await rateLimit(`ticket:${userId}`, 3, 60_000)).ok) return;
 
   const raw = {

src/actions/link-discord.ts

@@ -2,33 +2,32 @@
 
 import { prisma } from "@/lib/prisma";
 import { auth } from "@/lib/auth";
+import { logger } from "@/lib/logger";
 
 export async function linkDiscordId(discordId: string): Promise<string | null> {
   const session = await auth();
-  if (!session?.user?.id) return "Niet ingelogd";
+  if (!session?.user?.id) return "Not logged in";
 
   const userId = Number(session.user.id);
   if (!discordId || !/^\d{17,20}$/.test(discordId.trim())) {
-    return "Ongeldig Discord ID";
+    return "Invalid Discord ID format";
   }
 
   const discordIdClean = discordId.trim();
 
-  // Check if this Discord ID is already linked to another account.
   try {
     const existing = await prisma.socialAccounts.findUnique({
       where: { provider_providerId: { provider: "discord", providerId: discordIdClean } },
       select: { userId: true },
     });
     if (existing && Number(existing.userId) !== userId) {
-      return "Dit Discord ID is al gekoppeld aan een ander account";
+      return "This Discord ID is already linked to another account";
     }
   } catch {
-    return "Fout bij controleren Discord ID";
+    return "Failed to check Discord ID";
   }
 
   try {
-    // Upsert: create or update the social_accounts entry.
     await prisma.socialAccounts.upsert({
       where: { provider_providerId: { provider: "discord", providerId: discordIdClean } },
       create: {
@@ -41,15 +40,14 @@ export async function linkDiscordId(discordId: string): Promise<string | null> {
       update: { userId: BigInt(userId), updatedAt: new Date() },
     });
 
-    // Mark user as verified.
     await prisma.user.update({
       where: { id: userId },
       data: { mailVerified: "1" },
     });
 
-    return null; // success
+    return null;
   } catch (e) {
-    console.error("[link-discord] Failed:", (e as Error).message);
-    return "Fout bij koppelen van Discord account";
+    logger.error("Failed to link Discord account", { module: "link-discord", error: (e as Error).message });
+    return "Failed to link Discord account";
   }
 }

src/actions/radio-shouts.ts

@@ -24,7 +24,7 @@ export async function postShout(formData: FormData): Promise<void> {
   const userId = Number(session?.user?.id);
   if (!Number.isInteger(userId) || userId <= 0) return;
 
-  const ip = await clientIp();
+  await clientIp();
   if (!(await rateLimit(`shout:${userId}`, 5, 30_000)).ok) return;
 
   const raw = {

src/actions/save-favicon.ts

@@ -23,11 +23,16 @@ export async function saveFavicon(formData: FormData): Promise<{ success: boolea
     };
     const ext = mimeExt[file.type] ?? "png";
     const filename = `favicon-${Date.now()}.${ext}`;
-    const dir = path.join(process.cwd(), FAVICON_DIR);
-    const filePath = path.join(dir, filename);
+    const baseDir = path.resolve(process.cwd(), FAVICON_DIR);
+    const filePath = path.resolve(baseDir, filename);
+    if (!filePath.startsWith(baseDir + path.sep)) {
+      return { success: false, error: "Invalid path" };
+    }
 
     const buffer = Buffer.from(await file.arrayBuffer());
-    await mkdir(dir, { recursive: true });
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
+    await mkdir(baseDir, { recursive: true });
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
     await writeFile(filePath, buffer);
 
     const url = `/api/media/favicon/${filename}`;
@@ -37,9 +42,13 @@ export async function saveFavicon(formData: FormData): Promise<{ success: boolea
     if (oldUrl && oldUrl.startsWith("/api/media/favicon/")) {
       const oldName = oldUrl.replace("/api/media/favicon/", "");
       if (!oldName.includes("..") && !oldName.includes("/")) {
-        try {
-          await unlink(path.join(dir, oldName));
-        } catch { /* ignore if file doesn't exist */ }
+        const oldPath = path.resolve(baseDir, oldName);
+        if (oldPath.startsWith(baseDir + path.sep)) {
+          try {
+            // eslint-disable-next-line security/detect-non-literal-fs-filename
+            await unlink(oldPath);
+          } catch { /* ignore if file doesn't exist */ }
+        }
       }
     }
 
@@ -63,12 +72,16 @@ export async function deleteFavicon(): Promise<{ success: boolean; error?: strin
   try {
     const oldUrl = await siteSettings.get("cms_favicon");
     if (oldUrl && oldUrl.startsWith("/api/media/favicon/")) {
-      const dir = path.join(process.cwd(), FAVICON_DIR);
+      const baseDir = path.resolve(process.cwd(), FAVICON_DIR);
       const oldName = oldUrl.replace("/api/media/favicon/", "");
       if (!oldName.includes("..") && !oldName.includes("/")) {
-        try {
-          await unlink(path.join(dir, oldName));
-        } catch { /* ignore */ }
+        const oldPath = path.resolve(baseDir, oldName);
+        if (oldPath.startsWith(baseDir + path.sep)) {
+          try {
+            // eslint-disable-next-line security/detect-non-literal-fs-filename
+            await unlink(oldPath);
+          } catch { /* ignore */ }
+        }
       }
     }
 

src/actions/save-logo.ts

@@ -13,14 +13,18 @@ export async function saveLogo(formData: FormData): Promise<{ success: boolean;
     const file = formData.get("file") as File | null;
     if (!file) return { success: false, error: "No file provided" };
 
-    const mimeExt: Record<string, string> = { "image/png": "png", "image/gif": "gif", "image/jpeg": "jpg", "image/webp": "webp" };
-    const ext = mimeExt[file.type] ?? "png";
+    const ext = file.type === "image/png" ? "png" : file.type === "image/gif" ? "gif" : file.type === "image/jpeg" ? "jpg" : file.type === "image/webp" ? "webp" : "png";
     const filename = `logo-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${ext}`;
-    const dir = path.join(process.cwd(), MEDIA_DIR);
-    const filePath = path.join(dir, filename);
+    const baseDir = path.resolve(process.cwd(), MEDIA_DIR);
+    const filePath = path.resolve(baseDir, filename);
+    if (!filePath.startsWith(baseDir + path.sep)) {
+      return { success: false, error: "Invalid path" };
+    }
 
     const buffer = Buffer.from(await file.arrayBuffer());
-    await mkdir(dir, { recursive: true });
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
+    await mkdir(baseDir, { recursive: true });
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
     await writeFile(filePath, buffer);
 
     const url = `/api/media/logo/${filename}`;
@@ -48,13 +52,17 @@ export async function saveLogoFromUrl(gifUrl: string): Promise<{ success: boolea
     const contentType = res.headers.get("content-type") ?? "image/gif";
     const buffer = Buffer.from(await res.arrayBuffer());
 
-    const mimeExt: Record<string, string> = { "image/png": "png", "image/gif": "gif", "image/jpeg": "jpg", "image/webp": "webp" };
-    const ext = mimeExt[contentType] ?? "gif";
+    const ext = contentType === "image/png" ? "png" : contentType === "image/gif" ? "gif" : contentType === "image/jpeg" ? "jpg" : contentType === "image/webp" ? "webp" : "gif";
     const filename = `logo-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${ext}`;
-    const dir = path.join(process.cwd(), MEDIA_DIR);
-    const filePath = path.join(dir, filename);
+    const baseDir = path.resolve(process.cwd(), MEDIA_DIR);
+    const filePath = path.resolve(baseDir, filename);
+    if (!filePath.startsWith(baseDir + path.sep)) {
+      return { success: false, error: "Invalid path" };
+    }
 
-    await mkdir(dir, { recursive: true });
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
+    await mkdir(baseDir, { recursive: true });
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
     await writeFile(filePath, buffer);
 
     const url = `/api/media/logo/${filename}`;

src/actions/twofactor.ts

@@ -7,7 +7,7 @@ import { LaravelEncrypter } from "@/lib/auth/laravel-encrypter";
 import { generateTotpSecret, verifyTotp } from "@/lib/auth/totp";
 import { auth } from "@/lib/auth";
 import { prisma } from "@/lib/prisma";
-import { clientIp, rateLimit } from "@/lib/rate-limit";
+import { rateLimit } from "@/lib/rate-limit";
 import { env } from "@/env";
 
 async function sessionUserId(): Promise<number> {

src/actions/voucher.ts

@@ -49,7 +49,7 @@ export async function redeem(
     maxUses: number;
     useCount: number;
     expiresAt: Date | null;
-  } | null = null;
+  } | null;
   try {
     voucher = await prisma.websiteShopVouchers.findUnique({
       where: { code },