vibecarbon 0.9.0 → 0.11.0

package/carbon/src/server/routes/v1/theme.ts

@@ -7,30 +7,51 @@ import type { HonoVariables } from '../../types';
 
 const themeRoutes = new Hono<{ Variables: HonoVariables }>();
 
-// Zod schema for theme validation — all fields optional
+// SECURITY: theme values are stored via PATCH and served publicly via GET, then
+// the client string-builds a `<style>` block from them (client/lib/theme.ts).
+// Unconstrained strings would allow CSS injection (breaking out of a
+// declaration with `;}` to add arbitrary rules). Constrain each field to a
+// known CSS color/length grammar so no structural characters can escape.
+//
+// Colors: hex (#rgb/#rgba/#rrggbb/#rrggbbaa) or a rgb()/rgba()/hsl()/hsla()/
+// oklch() function whose body is limited to digits, dot, comma, %, slash and
+// whitespace. Radius: a non-negative number with a px/rem/em/% unit, or `0`.
+const COLOR_RE =
+  /^(#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})|(?:rgba?|hsla?|oklch)\([\d.,%/\s]+\))$/;
+const RADIUS_RE = /^(0|\d*\.?\d+(px|rem|em|%))$/;
+
+const colorField = z.string().regex(COLOR_RE, 'Invalid color value').optional();
+const radiusField = z.string().regex(RADIUS_RE, 'Invalid radius value').optional();
+
 const colorSchemaFields = {
-  primary: z.string().optional(),
-  primaryDim: z.string().optional(),
-  primaryForeground: z.string().optional(),
-  secondaryAccent: z.string().optional(),
-  secondaryAccentForeground: z.string().optional(),
-  destructive: z.string().optional(),
-  warning: z.string().optional(),
-  success: z.string().optional(),
+  primary: colorField,
+  primaryDim: colorField,
+  primaryForeground: colorField,
+  secondaryAccent: colorField,
+  secondaryAccentForeground: colorField,
+  destructive: colorField,
+  warning: colorField,
+  success: colorField,
 };
 
+// NOTE: schema is non-strict (unknown keys are stripped, not rejected). The
+// admin UI also sends gradientStart/gradientEnd/card, which are NOT part of the
+// stored/served theme — they've always been stripped here, so the client falls
+// back to its built-in defaults for them. That means they are not a stored-XSS
+// vector (they never persist). Validating them would require intentionally
+// persisting them, which is a product decision, not a security fix — left as-is.
 const themeSchema = z.object({
   light: z.object(colorSchemaFields).optional(),
   dark: z
     .object({
-      primary: z.string().optional(),
-      primaryDim: z.string().optional(),
-      primaryForeground: z.string().optional(),
-      secondaryAccent: z.string().optional(),
-      secondaryAccentForeground: z.string().optional(),
+      primary: colorField,
+      primaryDim: colorField,
+      primaryForeground: colorField,
+      secondaryAccent: colorField,
+      secondaryAccentForeground: colorField,
     })
     .optional(),
-  radius: z.string().optional(),
+  radius: radiusField,
   smoothScrollEnabled: z.boolean().optional(),
   smoothScrollIntensity: z.number().min(0).max(100).optional(),
 });

package/carbon/supabase/migrations/00003_pg_cron.sql

@@ -74,7 +74,7 @@ SELECT cron.schedule(
     deleted_count INTEGER;
   BEGIN
     DELETE FROM public.failed_login_attempts
-    WHERE created_at < now() - interval '24 hours';
+    WHERE attempted_at < now() - interval '24 hours';
     GET DIAGNOSTICS deleted_count = ROW_COUNT;
     PERFORM public.log_cron_job('cleanup-login-attempts', 'succeeded',
       'Deleted ' || deleted_count || ' old login attempts');
@@ -94,7 +94,7 @@ SELECT cron.schedule(
     deleted_count INTEGER;
   BEGIN
     DELETE FROM public.notifications
-    WHERE expires_at IS NOT NULL AND expires_at < now();
+    WHERE ends_at IS NOT NULL AND ends_at < now();
     GET DIAGNOSTICS deleted_count = ROW_COUNT;
     PERFORM public.log_cron_job('cleanup-expired-notifications', 'succeeded',
       'Deleted ' || deleted_count || ' expired notifications');

package/carbon/supabase/migrations/00004_contact_newsletter.sql

@@ -26,11 +26,15 @@ CREATE POLICY "Super admins can manage contact submissions"
   ON public.contact_submissions FOR ALL
   USING (public.is_super_admin());
 
--- Allow anonymous inserts (public contact form)
+-- SECURITY: No direct-client (anon/authenticated) write policy exists on this
+-- table. The public contact form POSTs to /api/v1/newsletter/../contact, which
+-- writes via the server's service_role client (BYPASSRLS) — see
+-- routes/v1/contact.ts. A permissive `WITH CHECK (true)` INSERT policy would let
+-- ANY logged-in user (authenticated holds table INSERT grant, roles.sql) inject
+-- rows straight into PostgREST with no legitimate purpose. The DROP below is kept
+-- (without a matching CREATE) so re-applying this migration scrubs any
+-- previously-created permissive policy.
 DROP POLICY IF EXISTS "Anyone can submit contact form" ON public.contact_submissions;
-CREATE POLICY "Anyone can submit contact form"
-  ON public.contact_submissions FOR INSERT
-  WITH CHECK (true);
 
 DROP TRIGGER IF EXISTS update_contact_submissions_updated_at ON public.contact_submissions;
 CREATE TRIGGER update_contact_submissions_updated_at
@@ -63,18 +67,24 @@ CREATE POLICY "Super admins can manage newsletter subscribers"
   ON public.newsletter_subscribers FOR ALL
   USING (public.is_super_admin());
 
--- Allow anonymous inserts (public signup form)
+-- SECURITY: No direct-client (anon/authenticated) write policy exists on this
+-- table. The ENTIRE newsletter lifecycle is server-mediated via the service_role
+-- client (BYPASSRLS) in routes/v1/newsletter.ts:
+--   - subscribe  -> adminDb.upsert(...)   (double opt-in, server-set token)
+--   - confirm    -> adminDb.update(...).eq('confirmation_token', token)
+--   - unsubscribe-> adminDb.update(...).eq('email', email)
+-- The previous `FOR UPDATE USING (true) WITH CHECK (true)` policy was
+-- world-writable: because `authenticated` holds a table-level UPDATE grant
+-- (roles.sql), any logged-in user could PATCH /rest/v1/newsletter_subscribers
+-- directly and blind-overwrite EVERY subscriber row (status, email, token).
+-- The previous `FOR INSERT WITH CHECK (true)` policy was equally unscoped and let
+-- anyone inject rows / bypass double opt-in — with no legitimate use, since real
+-- signups insert via service_role. Both are removed. The DROPs are kept (without
+-- matching CREATEs) so re-applying this migration scrubs any previously-created
+-- permissive policy. Legitimate access remains: service_role (server) bypasses
+-- RLS; super admins use the "Super admins can manage" policy above.
 DROP POLICY IF EXISTS "Anyone can subscribe to newsletter" ON public.newsletter_subscribers;
-CREATE POLICY "Anyone can subscribe to newsletter"
-  ON public.newsletter_subscribers FOR INSERT
-  WITH CHECK (true);
-
--- Allow anonymous updates for confirmation/unsubscribe (by token or email)
 DROP POLICY IF EXISTS "Anyone can confirm or unsubscribe" ON public.newsletter_subscribers;
-CREATE POLICY "Anyone can confirm or unsubscribe"
-  ON public.newsletter_subscribers FOR UPDATE
-  USING (true)
-  WITH CHECK (true);
 
 DROP TRIGGER IF EXISTS update_newsletter_subscribers_updated_at ON public.newsletter_subscribers;
 CREATE TRIGGER update_newsletter_subscribers_updated_at

package/carbon/tests/component/supabase-env-guard.test.ts

@@ -0,0 +1,54 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+// The supabase module runs its env check at module load, before React mounts.
+// A bare throw leaves #root empty — a completely black page with the only
+// clue buried in the console. The guard must paint a human-readable
+// configuration error into the DOM *and* still throw to halt the app.
+describe('supabase env guard', () => {
+  beforeEach(() => {
+    vi.resetModules();
+    document.body.innerHTML = '<div id="root"></div>';
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    document.body.innerHTML = '';
+  });
+
+  it('renders a visible configuration error naming the missing vars before throwing', async () => {
+    vi.stubEnv('VITE_SUPABASE_URL', '');
+    vi.stubEnv('VITE_SUPABASE_ANON_KEY', '');
+
+    await expect(import('@/lib/supabase')).rejects.toThrow(
+      'Missing Supabase environment variables',
+    );
+
+    const text = document.body.textContent ?? '';
+    expect(text).toContain('Configuration error');
+    expect(text).toContain('VITE_SUPABASE_URL');
+    expect(text).toContain('VITE_SUPABASE_ANON_KEY');
+  });
+
+  it('names only the vars that are actually missing', async () => {
+    vi.stubEnv('VITE_SUPABASE_URL', 'http://localhost:54321');
+    vi.stubEnv('VITE_SUPABASE_ANON_KEY', '');
+
+    await expect(import('@/lib/supabase')).rejects.toThrow(
+      'Missing Supabase environment variables',
+    );
+
+    const text = document.body.textContent ?? '';
+    expect(text).toContain('VITE_SUPABASE_ANON_KEY');
+    expect(text).not.toContain('VITE_SUPABASE_URL,');
+  });
+
+  it('exports the client and paints nothing when env is present', async () => {
+    vi.stubEnv('VITE_SUPABASE_URL', 'http://localhost:54321');
+    vi.stubEnv('VITE_SUPABASE_ANON_KEY', 'test-anon-key');
+
+    const mod = await import('@/lib/supabase');
+
+    expect(mod.supabase).toBeDefined();
+    expect(document.body.textContent).not.toContain('Configuration error');
+  });
+});

package/carbon/tests/integration/server/middleware/rate-limit-ip-spoof.test.ts

@@ -0,0 +1,48 @@
+import { Hono } from 'hono';
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+
+vi.mock('@server/lib/logger', () => ({
+  logger: { warn: vi.fn(), error: vi.fn(), info: vi.fn(), debug: vi.fn() },
+}));
+
+// Real rate limiter + real trusted-IP resolver. No REDIS_URL in test env, so it
+// uses the in-memory store. Freeze timers so the InMemoryStore's cleanup
+// interval never fires and all requests land in the same window.
+const { createRateLimiter } = await import('@server/lib/rate-limiter');
+
+function appWithLimiter() {
+  const app = new Hono();
+  app.use('*', createRateLimiter({ windowMs: 60_000, max: 1 }));
+  app.get('/x', (c) => c.text('ok'));
+  return app;
+}
+
+function xffReq(xff: string) {
+  return new Request('http://local.test/x', { headers: { 'x-forwarded-for': xff } });
+}
+
+beforeAll(() => {
+  vi.useFakeTimers();
+});
+afterAll(() => {
+  vi.useRealTimers();
+});
+
+describe('rate limiter buckets by the trusted client IP, not spoofable XFF', () => {
+  it('SECURITY: rotating the spoofable leftmost XFF cannot mint a fresh bucket', async () => {
+    const app = appWithLimiter();
+
+    // First request from real client 198.51.100.7 (rightmost, Traefik-appended).
+    const first = await app.request(xffReq('1.1.1.1, 198.51.100.7'));
+    expect(first.status).toBe(200);
+
+    // Second request: attacker rotates the leftmost value hoping for a new bucket.
+    // Same real client → same bucket → limited (max: 1).
+    const second = await app.request(xffReq('2.2.2.2, 198.51.100.7'));
+    expect(second.status).toBe(429);
+
+    // Control: a genuinely different real client (different rightmost) is a fresh bucket.
+    const other = await app.request(xffReq('2.2.2.2, 203.0.113.42'));
+    expect(other.status).toBe(200);
+  });
+});

package/carbon/tests/integration/server/middleware/require-plan.test.ts

@@ -0,0 +1,101 @@
+import { Hono } from 'hono';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { HonoVariables } from '@server/types';
+
+// Mutable state driving the mocked billing config + DB rows.
+const { state } = vi.hoisted(() => ({
+  state: {
+    configured: true,
+    // resolveHighestPlan queries: personal customer (maybeSingle), memberships
+    // (await), org customers (await), subscriptions (await).
+    personalCustomer: null as { id: string } | null,
+    memberships: [] as Array<{ organization_id: string | null }>,
+    orgCustomers: [] as Array<{ id: string }>,
+    subscriptions: [] as Array<{ stripe_price_id: string; status: string }>,
+  },
+}));
+
+vi.mock('@server/billing', () => ({
+  isBillingConfigured: () => state.configured,
+  getProviderPriceIds: () => ({ starter: 'price_starter', pro: 'price_pro' }),
+}));
+vi.mock('@server/lib/logger', () => ({
+  logger: { warn: vi.fn(), error: vi.fn(), info: vi.fn(), debug: vi.fn() },
+}));
+
+// biome-ignore lint/suspicious/noExplicitAny: minimal thenable query-builder double
+function builder(onAwait: any, onMaybeSingle: any): any {
+  // biome-ignore lint/suspicious/noExplicitAny: builder is intentionally untyped
+  const b: any = {};
+  for (const m of ['select', 'eq', 'is', 'in', 'order']) b[m] = () => b;
+  b.maybeSingle = () => Promise.resolve(onMaybeSingle);
+  // Thenable so `await builder` resolves to onAwait.
+  b.then = (resolve: (v: unknown) => unknown, reject?: (e: unknown) => unknown) =>
+    Promise.resolve(onAwait).then(resolve, reject);
+  return b;
+}
+
+vi.mock('@server/lib/supabase', () => ({
+  supabaseAdmin: {
+    from: (table: string) => {
+      if (table === 'customers') {
+        // personal path uses maybeSingle; org path is awaited (.in())
+        return builder({ data: state.orgCustomers }, { data: state.personalCustomer });
+      }
+      if (table === 'memberships') return builder({ data: state.memberships }, { data: null });
+      if (table === 'subscriptions') return builder({ data: state.subscriptions }, { data: null });
+      return builder({ data: null }, { data: null });
+    },
+  },
+}));
+
+const { requirePlan } = await import('@server/middleware/requirePlan');
+
+function app() {
+  const a = new Hono<{ Variables: HonoVariables }>();
+  a.use('*', async (c, next) => {
+    // biome-ignore lint/suspicious/noExplicitAny: minimal injected user
+    c.set('user', { id: 'u1', email: 'u@test.com' } as any);
+    await next();
+  });
+  a.get('/pro', requirePlan('pro'), (c) => c.text('ok'));
+  return a;
+}
+
+beforeEach(() => {
+  state.configured = true;
+  state.personalCustomer = null;
+  state.memberships = [];
+  state.orgCustomers = [];
+  state.subscriptions = [];
+});
+
+describe('requirePlan (provider-agnostic + org-level subscriptions)', () => {
+  it('allows all requests when billing is not configured', async () => {
+    state.configured = false;
+    const res = await app().request('/pro');
+    expect(res.status).toBe(200);
+  });
+
+  it('returns 403 when the user has no active subscription anywhere', async () => {
+    const res = await app().request('/pro');
+    expect(res.status).toBe(403);
+    expect((await res.json()).requiredPlan).toBe('pro');
+  });
+
+  it('grants access via an ORGANIZATION subscription the user belongs to', async () => {
+    state.memberships = [{ organization_id: 'org1' }];
+    state.orgCustomers = [{ id: 'cust_org1' }];
+    state.subscriptions = [{ stripe_price_id: 'price_pro', status: 'active' }];
+    const res = await app().request('/pro');
+    expect(res.status).toBe(200);
+  });
+
+  it('does not grant pro access for an org subscription only at the starter tier', async () => {
+    state.memberships = [{ organization_id: 'org1' }];
+    state.orgCustomers = [{ id: 'cust_org1' }];
+    state.subscriptions = [{ stripe_price_id: 'price_starter', status: 'active' }];
+    const res = await app().request('/pro');
+    expect(res.status).toBe(403);
+  });
+});

package/carbon/tests/integration/server/routes/admin-newsletter.test.ts

@@ -0,0 +1,93 @@
+import type { User } from '@supabase/supabase-js';
+import { Hono } from 'hono';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { HonoVariables } from '@server/types';
+
+const { orderMock } = vi.hoisted(() => ({ orderMock: vi.fn() }));
+
+vi.mock('@server/lib/supabase', () => ({
+  supabaseAdmin: {
+    from: () => ({ select: () => ({ eq: () => ({ order: orderMock }) }) }),
+  },
+}));
+vi.mock('@server/lib/email', () => ({ sendEmail: vi.fn().mockResolvedValue(undefined) }));
+vi.mock('@server/lib/env', () => ({ env: { SITE_URL: 'https://app.test' } }));
+vi.mock('@server/lib/logger', () => ({
+  logger: { warn: vi.fn(), error: vi.fn(), info: vi.fn(), debug: vi.fn() },
+}));
+
+const { adminNewsletterRoutes } = await import('@server/routes/v1/admin/newsletter');
+
+function appWithUser(user: Partial<User> | null) {
+  const app = new Hono<{ Variables: HonoVariables }>();
+  app.use('*', async (c, next) => {
+    // biome-ignore lint/suspicious/noExplicitAny: minimal injected user
+    c.set('user', (user as any) ?? null);
+    await next();
+  });
+  app.route('/api/v1/admin/newsletter', adminNewsletterRoutes);
+  return app;
+}
+
+beforeEach(() => orderMock.mockReset());
+
+describe('admin newsletter super-admin guard (requireSuperAdmin)', () => {
+  it('returns 401 when unauthenticated', async () => {
+    const res = await appWithUser(null).request('/api/v1/admin/newsletter/export');
+    expect(res.status).toBe(401);
+  });
+
+  it('returns 403 for a non-super-admin (guard no longer fails closed for admins)', async () => {
+    const res = await appWithUser({ id: 'u1', app_metadata: { role: 'authenticated' } }).request(
+      '/api/v1/admin/newsletter/export'
+    );
+    expect(res.status).toBe(403);
+  });
+
+  it('allows a super_admin through', async () => {
+    orderMock.mockResolvedValue({ data: [], error: null });
+    const res = await appWithUser({ id: 'u1', app_metadata: { role: 'super_admin' } }).request(
+      '/api/v1/admin/newsletter/export'
+    );
+    expect(res.status).toBe(200);
+  });
+});
+
+describe('newsletter CSV export escaping (formula/CSV injection)', () => {
+  it('SECURITY: neutralizes a formula-triggering name and quotes fields', async () => {
+    orderMock.mockResolvedValue({
+      data: [
+        {
+          email: 'a@b.com',
+          name: '=SUM(1+1)',
+          status: 'active',
+          subscribed_at: null,
+          created_at: '2026-01-01',
+        },
+        {
+          email: 'c@d.com',
+          name: 'Ada, "The First"',
+          status: 'active',
+          subscribed_at: '2026-01-02',
+          created_at: '2026-01-03',
+        },
+      ],
+      error: null,
+    });
+
+    const res = await appWithUser({ id: 'u1', app_metadata: { role: 'super_admin' } }).request(
+      '/api/v1/admin/newsletter/export'
+    );
+    expect(res.status).toBe(200);
+    const csv = await res.text();
+
+    // Formula neutralized with a leading apostrophe, and quoted.
+    expect(csv).toContain('"\'=SUM(1+1)"');
+    // No unescaped formula cell (would let a spreadsheet execute it).
+    expect(csv).not.toContain(',=SUM(1+1),');
+    // Field with comma + embedded quotes is quoted and quotes doubled.
+    expect(csv).toContain('"Ada, ""The First"""');
+    // Every field is quoted.
+    expect(csv).toContain('"a@b.com"');
+  });
+});

package/carbon/tests/integration/server/routes/billing-subscription-idor.test.ts

@@ -0,0 +1,92 @@
+import { Hono } from 'hono';
+import { describe, expect, it, vi } from 'vitest';
+import type { HonoVariables } from '@server/types';
+
+// adminDb (service role) is used by the handler AFTER the org membership gate.
+// A customer lookup that returns null yields {status:'none'} — enough to prove
+// the request reached the handler (i.e. the gate passed).
+const adminChain = {
+  select: () => adminChain,
+  eq: () => adminChain,
+  is: () => adminChain,
+  maybeSingle: async () => ({ data: null, error: null }),
+};
+vi.mock('@server/lib/supabase', () => ({ supabaseAdmin: { from: () => adminChain } }));
+vi.mock('@server/lib/logger', () => ({
+  logger: { warn: vi.fn(), error: vi.fn(), info: vi.fn(), debug: vi.fn() },
+}));
+vi.mock('@server/billing', () => ({
+  isBillingConfigured: () => true,
+  getBillingProvider: () => ({ type: 'stripe' }),
+  getProviderPriceIds: () => ({}),
+}));
+
+const { billingRoutes } = await import('@server/routes/v1/billing');
+
+// Build an app that injects an authenticated user + a fake RLS-enforced
+// per-user Supabase client whose memberships lookup returns `membershipRole`.
+function appWith(membershipRole: string | null) {
+  const app = new Hono<{ Variables: HonoVariables }>();
+  app.use('*', async (c, next) => {
+    // biome-ignore lint/suspicious/noExplicitAny: minimal injected user
+    c.set('user', { id: 'u1', email: 'u@test.com' } as any);
+    c.set('aal', 'aal2');
+    // biome-ignore lint/suspicious/noExplicitAny: minimal supabase double
+    c.set('supabase', {
+      from: () => ({
+        select: () => ({
+          eq: () => ({
+            eq: () => ({
+              single: async () => ({
+                data: membershipRole ? { role: membershipRole } : null,
+                error: membershipRole ? null : { message: 'no rows' },
+              }),
+            }),
+          }),
+        }),
+      }),
+    } as any);
+    await next();
+  });
+  app.route('/api/v1/billing', billingRoutes);
+  return app;
+}
+
+const ORG = '00000000-0000-0000-0000-0000000000aa';
+
+describe('GET /billing/subscription org access control (IDOR fix)', () => {
+  it('SECURITY: returns 403 when the caller is not a member of the target org', async () => {
+    const res = await appWith(null).request(
+      `/api/v1/billing/subscription?type=organization&organizationId=${ORG}`
+    );
+    expect(res.status).toBe(403);
+  });
+
+  it('allows an OWNER of the target org through the gate', async () => {
+    const res = await appWith('OWNER').request(
+      `/api/v1/billing/subscription?type=organization&organizationId=${ORG}`
+    );
+    expect(res.status).toBe(200);
+    expect((await res.json()).status).toBe('none');
+  });
+
+  it('rejects a non-privileged member (e.g. MEMBER role)', async () => {
+    const res = await appWith('MEMBER').request(
+      `/api/v1/billing/subscription?type=organization&organizationId=${ORG}`
+    );
+    expect(res.status).toBe(403);
+  });
+
+  it('requires an organizationId for organization-scoped requests', async () => {
+    const res = await appWith('OWNER').request(
+      '/api/v1/billing/subscription?type=organization'
+    );
+    expect(res.status).toBe(400);
+  });
+
+  it('is inert for user-scoped requests (no org membership needed)', async () => {
+    const res = await appWith(null).request('/api/v1/billing/subscription?type=user');
+    expect(res.status).toBe(200);
+    expect((await res.json()).status).toBe('none');
+  });
+});

package/carbon/tests/integration/server/routes/newsletter-unsubscribe.test.ts

@@ -0,0 +1,65 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { mountRoute } from '../../../_helpers/app';
+
+const { maybeSingleMock, fromSpy } = vi.hoisted(() => ({
+  maybeSingleMock: vi.fn(),
+  fromSpy: vi.fn(),
+}));
+
+vi.mock('@server/lib/supabase', () => ({
+  supabaseAdmin: {
+    from: (...args: unknown[]) => {
+      fromSpy(...args);
+      return {
+        update: () => ({
+          eq: () => ({
+            eq: () => ({ select: () => ({ maybeSingle: maybeSingleMock }) }),
+          }),
+        }),
+      };
+    },
+  },
+}));
+vi.mock('@server/lib/email', () => ({ sendEmail: vi.fn().mockResolvedValue(undefined) }));
+vi.mock('@server/lib/env', () => ({ env: { SITE_URL: 'https://app.test' } }));
+vi.mock('@server/lib/logger', () => ({
+  logger: { warn: vi.fn(), error: vi.fn(), info: vi.fn(), debug: vi.fn() },
+}));
+vi.mock('@server/lib/rate-limiter', () => ({
+  createRateLimiter: () => async (_c: unknown, next: () => Promise<void>) => {
+    await next();
+  },
+}));
+
+const { newsletterRoutes } = await import('@server/routes/v1/newsletter');
+const app = mountRoute('/api/v1/newsletter', newsletterRoutes);
+
+beforeEach(() => {
+  maybeSingleMock.mockReset();
+  fromSpy.mockReset();
+});
+
+describe('GET /newsletter/unsubscribe token requirement (finding 6)', () => {
+  it('SECURITY: rejects an unsubscribe with only an email (no token) and never touches the DB', async () => {
+    const res = await app.request('/api/v1/newsletter/unsubscribe?email=victim@example.com');
+    expect(res.status).toBe(400);
+    expect(fromSpy).not.toHaveBeenCalled();
+  });
+
+  it('unsubscribes when email + matching confirmation_token are supplied', async () => {
+    maybeSingleMock.mockResolvedValue({ data: { id: 'sub-1' }, error: null });
+    const res = await app.request(
+      '/api/v1/newsletter/unsubscribe?email=user@example.com&token=good-token'
+    );
+    expect(res.status).toBe(302);
+    expect(res.headers.get('location')).toContain('newsletter=unsubscribed');
+  });
+
+  it('SECURITY: rejects a non-matching token (no row updated)', async () => {
+    maybeSingleMock.mockResolvedValue({ data: null, error: null });
+    const res = await app.request(
+      '/api/v1/newsletter/unsubscribe?email=user@example.com&token=wrong-token'
+    );
+    expect(res.status).toBe(400);
+  });
+});

package/carbon/tests/integration/server/routes/theme-validation.test.ts

@@ -0,0 +1,66 @@
+import type { User } from '@supabase/supabase-js';
+import { Hono } from 'hono';
+import { describe, expect, it, vi } from 'vitest';
+import { jsonPost } from '../../../_helpers/app';
+import type { HonoVariables } from '@server/types';
+
+vi.mock('@server/lib/supabase', () => ({
+  supabaseAdmin: { from: () => ({ upsert: async () => ({ error: null }) }) },
+}));
+vi.mock('@server/lib/logger', () => ({
+  logger: { warn: vi.fn(), error: vi.fn(), info: vi.fn(), debug: vi.fn() },
+}));
+
+const { themeRoutes } = await import('@server/routes/v1/theme');
+
+function adminApp() {
+  const app = new Hono<{ Variables: HonoVariables }>();
+  app.use('*', async (c, next) => {
+    // biome-ignore lint/suspicious/noExplicitAny: minimal injected super admin
+    c.set('user', { id: 'admin1', app_metadata: { role: 'super_admin' } } as Partial<User> as any);
+    await next();
+  });
+  app.route('/api/v1/admin/theme', themeRoutes);
+  return app;
+}
+
+function patch(theme: unknown) {
+  return adminApp().request('/api/v1/admin/theme', {
+    ...jsonPost(theme),
+    method: 'PATCH',
+  });
+}
+
+describe('PATCH /admin/theme color/radius validation (stored XSS / CSS injection)', () => {
+  it('accepts valid oklch / hex colors and a unit radius', async () => {
+    const res = await patch({
+      light: { primary: 'oklch(0.52 0.124 192)', destructive: '#ff0000' },
+      dark: { primary: 'oklch(0.82 0.14 192)' },
+      radius: '0.625rem',
+    });
+    expect(res.status).toBe(200);
+    expect((await res.json()).success).toBe(true);
+  });
+
+  it('SECURITY: rejects a CSS breakout payload in a color field', async () => {
+    const res = await patch({ light: { primary: 'red; } body { background: url(//evil) } .x {' } });
+    expect(res.status).toBe(400);
+  });
+
+  it('SECURITY: rejects a non-color string (e.g. url / expression)', async () => {
+    const res = await patch({ light: { warning: 'url(javascript:alert(1))' } });
+    expect(res.status).toBe(400);
+  });
+
+  it('SECURITY: rejects a radius that smuggles extra declarations', async () => {
+    const res = await patch({ radius: '1rem; } :root { --primary: red' });
+    expect(res.status).toBe(400);
+  });
+
+  it('accepts rgb()/hsl() color forms', async () => {
+    const res = await patch({
+      light: { primary: 'rgb(12, 34, 56)', secondaryAccent: 'hsl(210, 50%, 40%)' },
+    });
+    expect(res.status).toBe(200);
+  });
+});