Reject client supplied account roles

src/server.ts

@@ -51,7 +51,7 @@ const passwordResetRequestLimiter = rateLimit({ windowMs: 60 * 60 * 1000, limit:
 const passwordRecoveryLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 15, standardHeaders: "draft-8", legacyHeaders: false });
 const apiLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 3000, standardHeaders: "draft-8", legacyHeaders: false });
 const analysisUploadLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 4, standardHeaders: "draft-8", legacyHeaders: false });
-const signupSchema = z.object({ fname: z.string().trim().min(1).max(100), lname: z.string().trim().min(1).max(100), email: z.string().trim().toLowerCase().email().max(255), password: z.string().min(8).max(128), academy: z.string().trim().max(150).optional() });
+const signupSchema = z.object({ fname: z.string().trim().min(1).max(100), lname: z.string().trim().min(1).max(100), email: z.string().trim().toLowerCase().email().max(255), password: z.string().min(8).max(128), academy: z.string().trim().max(150).optional() }).strict();
 const loginSchema = z.object({ email: z.string().trim().toLowerCase().email(), password: z.string().min(1).max(128) });
 const passwordResetRequestSchema = z.object({ email: z.string().trim().toLowerCase().email().max(255) });
 const passwordRecoveryVerifySchema = z.object({ tokenHash: z.string().trim().min(1).max(512) });
@@ -62,7 +62,7 @@ const profileSchema = z.object({
   lname: z.string().trim().min(1).max(100),
   academy: z.string().trim().max(150).transform((value) => value || null).nullable(),
   role: z.enum(profileRoles).nullable(),
-});
+}).strict();
 const passwordSchema = z.object({ currentPassword: z.string().max(128).optional(), newPassword: z.string().min(8).max(128) });
 const actionReviewSchema = z.object({
   coachScore: z.number().int().min(0).max(10).nullable(),

src/supabase.ts

@@ -65,6 +65,7 @@ export async function syncProfile(user: User, profile?: { fname?: string; lname?
     email: user.email,
     academy: profile?.academy ?? metadata.academy ?? null,
     role: profile?.role ?? metadata.role ?? null,
+    account_role: "user",
   };
   const { error } = await supabaseAdmin.from("users").insert({ ...fields, password_hash: profile?.passwordHash ?? await randomPasswordHash() });
   if (error) throw new Error(`Unable to create user profile: ${error.message}`);